grok-bot-bin
MEDIUM
maintainer falser
6 votes
scanned 2026-10-04 00:18:08.092502
Why flagged
The package downloads a prebuilt .deb binary from a non-whitelisted host (downloads.cursor.com), which is not a standard code forge or vendor domain, creating a supply-chain risk if the host were compromised or the download redirected.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
"grok-bot_${pkgver}_amd64.deb::https://downloads.cursor.com/grokbot/stable/${_commit}/linux/x64/grok-bot_${pkgver}_amd64.deb"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb binary from a non-whitelisted host (downloads.cursor.com), which is not a standard code forge or vendor domain, creating a supply-chain risk if the host were compromised or the download redirected.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: falser <zjf_0731@163.com>
2
# Co-Maintainer: rafaeloledo <rafaeloliveiraledo@gmail.com>
3
4
pkgname=grok-bot-bin
5
pkgver=0.59.1
6
pkgrel=1
7
pkgdesc='Grok Bot desktop agent'
8
arch=('x86_64')
9
url='https://cursor.com'
10
license=('LicenseRef-Proprietary')
11
depends=(
12
gtk3
13
libnotify
14
nss
15
libxss
16
libxtst
17
xdg-utils
18
at-spi2-core
19
util-linux-libs
20
libsecret
21
hicolor-icon-theme
22
alsa-lib
23
libappindicator
24
)
25
makedepends=('python')
26
optdepends=('apparmor: load the shipped userns profile')
27
provides=('sand' 'grok-bot')
28
conflicts=('sand' 'grok-bot' 'grokbot-linux-port' 'grokbot-linux-port-bin')
29
replaces=('grok-bot')
30
options=('!strip' '!debug')
31
_commit=1d382f86e90289af505e2ce87b6be681aa8d2660
32
source=(
33
"grok-bot_${pkgver}_amd64.deb::https://downloads.cursor.com/grokbot/stable/${_commit}/linux/x64/grok-bot_${pkgver}_amd64.deb"
34
grok-bot.sh
35
linux-tray.cjs
36
extract-asar.py
37
)
38
sha256sums=(
39
'2a9155c257d9fa78ab30d2e66977391a3c3afd2f3a06a8f4843918f055a05292'
40
'9b3cccfada1dbe44ce794177181515aaf328603484327ef72a914234544bfbf8'
41
'9ea1f1939677ec7364bc024ec4b87f8873ef41e6b1b5cec407d0a022ca3678f6'
42
'86e6a9d2ce60f974c002a0187fdca7f111744ff4a1187dc70ba415fe6c715942'
43
)
44
noextract=("grok-bot_${pkgver}_amd64.deb")
45
46
package() {
47
bsdtar -O -xf "grok-bot_${pkgver}_amd64.deb" data.tar.xz \
48
| bsdtar -C "${pkgdir}" -xJf -
49
50
# Keep app.asar packed. Unpacking makes the renderer load Vite chunks
51
# over file://, which Chromium rejects as failed dynamic imports.
52
# Inject a StatusNotifierItem wrapper (Omarchy/Hyprland tray) into the asar.
53
local _res="${pkgdir}/opt/Grok Bot/resources"
54
python "${srcdir}/extract-asar.py" inject-tray \
55
"${_res}/app.asar" "${_res}/app.asar.unpacked" \
56
"${srcdir}/linux-tray.cjs"
57
58
# electron-builder now ships an unconfined userns profile. Debian
59
# postinst copies it to /etc/apparmor.d; pacman never runs that.
60
install -Dm644 "${_res}/apparmor-profile" \
61
"${pkgdir}/etc/apparmor.d/${pkgname%-bin}"
62
63
# Debian postinst uses update-alternatives; pacman never runs it.
64
install -Dm755 grok-bot.sh "${pkgdir}/usr/bin/grok-bot"
65
ln -s grok-bot "${pkgdir}/usr/bin/sand"
66
67
sed -i 's|^Exec=.*|Exec=grok-bot %U|' \
68
"${pkgdir}/usr/share/applications/grok-bot.desktop"
69
70
install -Dm644 "${pkgdir}/opt/Grok Bot/LICENSE.electron.txt" \
71
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
72
install -Dm644 "${pkgdir}/opt/Grok Bot/LICENSES.chromium.html" \
73
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
74
75
rm -rf "${pkgdir}/usr/share/doc"
76
77
# SUID chrome-sandbox is only needed when user namespaces are unavailable
78
# (e.g. linux-hardened). Stock Arch kernels already provide them.
79
if ! { [[ -L /proc/self/ns/user ]] && unshare --user true; }; then
80
chmod 4755 "${pkgdir}/opt/Grok Bot/chrome-sandbox"
81
fi
82
}
83
Changes since previous scan
--- PKGBUILD @ 2026-09-26 00:12+++ PKGBUILD @ 2026-10-04 00:18@@ -2,7 +2,7 @@ # Co-Maintainer: rafaeloledo <rafaeloliveiraledo@gmail.com> pkgname=grok-bot-bin-pkgver=0.57.1+pkgver=0.59.1 pkgrel=1 pkgdesc='Grok Bot desktop agent' arch=('x86_64')@@ -28,7 +28,7 @@ conflicts=('sand' 'grok-bot' 'grokbot-linux-port' 'grokbot-linux-port-bin') replaces=('grok-bot') options=('!strip' '!debug')-_commit=c4074f405d36a56b406f11cc6485404ff8b395eb+_commit=1d382f86e90289af505e2ce87b6be681aa8d2660 source=( "grok-bot_${pkgver}_amd64.deb::https://downloads.cursor.com/grokbot/stable/${_commit}/linux/x64/grok-bot_${pkgver}_amd64.deb" grok-bot.sh@@ -36,7 +36,7 @@ extract-asar.py ) sha256sums=(- 'ca034cc1db2526ea8727bce232818434057caca9e5a0a737721ad0bf2a5f4bf3'+ '2a9155c257d9fa78ab30d2e66977391a3c3afd2f3a06a8f4843918f055a05292' '9b3cccfada1dbe44ce794177181515aaf328603484327ef72a914234544bfbf8' '9ea1f1939677ec7364bc024ec4b87f8873ef41e6b1b5cec407d0a022ca3678f6' '86e6a9d2ce60f974c002a0187fdca7f111744ff4a1187dc70ba415fe6c715942'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-04 00:18:08 | Medium | 2 |
| 2026-10-03 00:23:04 | Medium | 2 |
| 2026-10-02 00:00:32 | Medium | 2 |
| 2026-10-01 00:02:06 | Medium | 2 |
| 2026-09-30 00:20:07 | Medium | 2 |
| 2026-09-29 00:07:46 | Medium | 2 |
| 2026-09-28 00:28:32 | Medium | 2 |
| 2026-09-27 01:16:09 | Medium | 2 |
| 2026-09-27 00:07:07 | Medium | 2 |
| 2026-09-26 07:14:17 | Medium | 2 |
| 2026-09-26 00:12:15 | Medium | 2 |
| 2026-09-25 00:03:36 | Medium | 2 |
| 2026-09-24 05:42:19 | Medium | 2 |
| 2026-09-24 00:24:14 | Medium | 2 |
| 2026-09-23 00:28:13 | Medium | 2 |
| 2026-09-22 00:15:14 | Medium | 2 |
| 2026-09-21 00:26:32 | Medium | 2 |
| 2026-09-20 19:33:19 | Medium | 2 |
| 2026-09-20 00:25:31 | Medium | 2 |
| 2026-09-19 00:25:36 | Medium | 2 |