skills/wangnov/grok-skills/grok/Gen Agent Trust Hub

grok

Pass

Audited by Gen Agent Trust Hub on Jul 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses child_process.spawn and execFileSync in scripts like grok-media.mjs and preflight.mjs to execute the grok CLI and ffmpeg binaries. These operations are core to the skill's functionality for generating media and performing environment checks.
  • [EXTERNAL_DOWNLOADS]: The documentation and preflight.mjs script reference official installation scripts from x.ai (https://x.ai/cli/install.sh and https://x.ai/cli/install.ps1). These are standard installation methods for the required third-party CLI tool.
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions for installing the Grok CLI by piping remote scripts from x.ai directly into shell interpreters (bash/PowerShell). As these originate from a well-known technology service, this is considered a standard setup procedure for this specific toolset.
  • [DATA_EXFILTRATION]: The grok-search.mjs script interacts with the official xAI API (api.x.ai). It accesses local configuration files (.env, .env.local) to load API keys and checks ~/.grok/auth.json for login status, which is required for its intended search and media generation features.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 12, 2026, 06:07 PM
Security Audit — agent-trust-hub — grok