grok
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
child_process.spawnandexecFileSyncin scripts likegrok-media.mjsandpreflight.mjsto execute thegrokCLI andffmpegbinaries. These operations are core to the skill's functionality for generating media and performing environment checks. - [EXTERNAL_DOWNLOADS]: The documentation and
preflight.mjsscript reference official installation scripts from x.ai (https://x.ai/cli/install.shandhttps://x.ai/cli/install.ps1). These are standard installation methods for the required third-party CLI tool. - [REMOTE_CODE_EXECUTION]: The skill provides instructions for installing the Grok CLI by piping remote scripts from
x.aidirectly into shell interpreters (bash/PowerShell). As these originate from a well-known technology service, this is considered a standard setup procedure for this specific toolset. - [DATA_EXFILTRATION]: The
grok-search.mjsscript interacts with the official xAI API (api.x.ai). It accesses local configuration files (.env,.env.local) to load API keys and checks~/.grok/auth.jsonfor login status, which is required for its intended search and media generation features.
Audit Metadata