grok-bot-bin

LOW

maintainer falser 1 votes scanned 2026-08-20 07:12:46.586583

View on AUR

Why flagged

Downloads a prebuilt .deb from downloads.cursor.com, which is plausibly the official distribution host for Cursor/Grok Bot; the SHA256 checksum is provided and non-trivial, reducing swap risk, though the host is not widely established and the package has few votes.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a prebuilt .deb from downloads.cursor.com, which is plausibly the official distribution host for Cursor/Grok Bot; the SHA256 checksum is provided and non-trivial, reducing swap risk, though the host is not widely established and the package has few votes.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("Grok_Bot_${pkgver}.deb::https://downloads.cursor.com/grokbot/stable/${_commit}/linux/x64/Grok_Bot_${pkgver}.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: falser <zjf_0731 at 163 dot com>
    
      2pkgname=grok-bot-bin
    
      3pkgver=0.20.0
    
      4pkgrel=1
    
      5pkgdesc='Grok Bot desktop agent'
    
      6arch=('x86_64')
    
      7url='https://cursor.com'
    
      8license=('LicenseRef-Proprietary')
    
      9depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'xdg-utils' 'at-spi2-core' 'util-linux-libs' 'libsecret' 'hicolor-icon-theme' 'alsa-lib')
    
      10optdepends=('libappindicator-gtk3: tray support')
    
      11provides=("${pkgname%-bin}")
    
      12conflicts=("${pkgname%-bin}")
    
      13options=('!strip' '!debug')
    
      14_commit=ca2c2b6f79b6130a4822d8189711b0f79f9d4661
    
      15source=("Grok_Bot_${pkgver}.deb::https://downloads.cursor.com/grokbot/stable/${_commit}/linux/x64/Grok_Bot_${pkgver}.deb")
    
      16sha256sums=('67a6eb6164ab233a5c5d4d50665efada2cbaae9f22efade85e934a65fdfbb20d')
    
      17noextract=("Grok_Bot_${pkgver}.deb")
    
      18
    
      19package() {
    
      20    bsdtar -O -xf "Grok_Bot_${pkgver}.deb" data.tar.xz | bsdtar -C "${pkgdir}" -xJf -
    
      21
    
      22    install -Dm644 "${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/grok-bot.png" \
    
      23        "${pkgdir}/usr/share/icons/hicolor/512x512/apps/grok-bot.png"
    
      24
    
      25    install -d "${pkgdir}/usr/bin"
    
      26    ln -s "/opt/Grok Bot/grok-bot" "${pkgdir}/usr/bin/grok-bot"
    
      27
    
      28    install -Dm644 "${pkgdir}/opt/Grok Bot/LICENSE.electron.txt" \
    
      29        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      30
    
      31    if ! { [[ -L /proc/self/ns/user ]] && unshare --user true; }; then
    
      32        chmod 4755 "${pkgdir}/opt/Grok Bot/chrome-sandbox"
    
      33    fi
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-20 07:12:46	Low	3
2026-08-20 07:10:50	Medium	3