grok-bot-cursor
MEDIUM
maintainer unixv
0 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The package downloads a prebuilt .deb from a non-whitelisted host (downloads.cursor.com) which is not a common forge or vendor CDN; while likely the official build, the source is unverifiable and could be swapped with a malicious binary.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:44
"grok-bot_${pkgver}_amd64.deb::https://downloads.cursor.com/grokbot/stable/${_commit}/linux/x64/grok-bot_${pkgver}_amd64.deb"
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-whitelisted host (downloads.cursor.com) which is not a common forge or vendor CDN; while likely the official build, the source is unverifiable and could be swapped with a malicious binary.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Barakah <sub@unixv.com>
2
#
3
# Official Cursor Linux build of Grok Bot, repackaged for Arch.
4
# The package name matches this directory so the tree can be pushed to the AUR.
5
#
6
# Bump pkgver, _commit, and the .deb checksum together, then commit that
7
# version on its own. The linux-x64 update feed carries the release commit:
8
# https://api2.cursor.sh/updates/api/update/linux-x64/sand/0.0.0/00000000-0000-0000-0000-000000000000/stable
9
# https://downloads.cursor.com/grokbot/stable/<commit>/linux/x64/grok-bot_<version>_amd64.deb
10
11
pkgname=grok-bot-cursor
12
pkgver=0.71.2
13
pkgrel=1
14
pkgdesc='Grok Bot desktop agent'
15
arch=('x86_64')
16
url='https://cursor.com'
17
license=('LicenseRef-Proprietary')
18
depends=(
19
gtk3
20
libnotify
21
nss
22
libxss
23
libxtst
24
xdg-utils
25
at-spi2-core
26
util-linux-libs
27
libsecret
28
alsa-lib
29
mesa
30
libxkbcommon
31
libdrm
32
hicolor-icon-theme
33
)
34
optdepends=(
35
'apparmor: load the shipped userns profile'
36
'libappindicator: system tray icon'
37
)
38
provides=('grok-bot' 'sand')
39
conflicts=('grok-bot' 'grok-bot-bin' 'sand' 'grokbot-linux-port' 'grokbot-linux-port-bin')
40
replaces=('grok-bot' 'grok-bot-bin')
41
options=('!strip' '!debug')
42
_commit=92808c0ad869b2e3725dbc3b8fa2fcc991687502
43
source=(
44
"grok-bot_${pkgver}_amd64.deb::https://downloads.cursor.com/grokbot/stable/${_commit}/linux/x64/grok-bot_${pkgver}_amd64.deb"
45
grok-bot.sh
46
)
47
sha256sums=(
48
'a0526d75a3e852ed59e507889bc3aa6a5185a8d043632ce8deca98b04ab06348'
49
'9b3cccfada1dbe44ce794177181515aaf328603484327ef72a914234544bfbf8'
50
)
51
noextract=("grok-bot_${pkgver}_amd64.deb")
52
53
package() {
54
bsdtar -O -xf "grok-bot_${pkgver}_amd64.deb" data.tar.xz \
55
| bsdtar -C "${pkgdir}" -xJf -
56
57
# electron-builder ships an unconfined userns profile. Debian postinst
58
# copies it to /etc/apparmor.d; pacman never runs that script.
59
install -Dm644 "${pkgdir}/opt/Grok Bot/resources/apparmor-profile" \
60
"${pkgdir}/etc/apparmor.d/grok-bot"
61
62
# Debian postinst uses update-alternatives; pacman never runs it.
63
install -Dm755 grok-bot.sh "${pkgdir}/usr/bin/grok-bot"
64
ln -s grok-bot "${pkgdir}/usr/bin/sand"
65
66
sed -i 's|^Exec=.*|Exec=grok-bot %U|' \
67
"${pkgdir}/usr/share/applications/grok-bot.desktop"
68
69
install -Dm644 "${pkgdir}/opt/Grok Bot/LICENSE.electron.txt" \
70
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
71
install -Dm644 "${pkgdir}/opt/Grok Bot/LICENSES.chromium.html" \
72
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
73
74
rm -rf "${pkgdir}/usr/share/doc"
75
76
# SUID chrome-sandbox is only needed when user namespaces are unavailable
77
# (for example linux-hardened). Stock Arch kernels already provide them.
78
if ! { [[ -L /proc/self/ns/user ]] && unshare --user true; }; then
79
chmod 4755 "${pkgdir}/opt/Grok Bot/chrome-sandbox"
80
fi
81
}
82
Changes since previous scan
--- PKGBUILD @ 2026-10-16 00:12+++ PKGBUILD @ 2026-10-17 00:21@@ -9,8 +9,8 @@ # https://downloads.cursor.com/grokbot/stable/<commit>/linux/x64/grok-bot_<version>_amd64.deb pkgname=grok-bot-cursor-pkgver=0.68.1-pkgrel=2+pkgver=0.71.2+pkgrel=1 pkgdesc='Grok Bot desktop agent' arch=('x86_64') url='https://cursor.com'@@ -39,13 +39,13 @@ conflicts=('grok-bot' 'grok-bot-bin' 'sand' 'grokbot-linux-port' 'grokbot-linux-port-bin') replaces=('grok-bot' 'grok-bot-bin') options=('!strip' '!debug')-_commit=33103062f95061ccf9c81c5b365d37ab152c3b66+_commit=92808c0ad869b2e3725dbc3b8fa2fcc991687502 source=( "grok-bot_${pkgver}_amd64.deb::https://downloads.cursor.com/grokbot/stable/${_commit}/linux/x64/grok-bot_${pkgver}_amd64.deb" grok-bot.sh ) sha256sums=(- 'b2be8106d2b3eae07d983d5f1ca77b657accde666dc440db2a409421ecff3359'+ 'a0526d75a3e852ed59e507889bc3aa6a5185a8d043632ce8deca98b04ab06348' '9b3cccfada1dbe44ce794177181515aaf328603484327ef72a914234544bfbf8' ) noextract=("grok-bot_${pkgver}_amd64.deb")Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Medium | 3 |
| 2026-10-16 09:15:55 | Medium | 3 |
| 2026-10-16 00:12:47 | Medium | 3 |
| 2026-10-15 00:28:05 | Medium | 3 |
| 2026-10-14 00:06:47 | Medium | 3 |
| 2026-10-13 00:23:45 | Medium | 3 |
| 2026-10-12 15:13:59 | Medium | 3 |
| 2026-10-12 00:18:51 | Medium | 3 |
| 2026-10-11 00:26:05 | Medium | 3 |
| 2026-10-10 00:11:52 | Medium | 3 |
| 2026-10-09 16:11:33 | Medium | 3 |
| 2026-10-09 14:14:00 | Medium | 3 |
| 2026-10-09 14:11:17 | Medium | 3 |