Grambot
Chat with your Grok Bot from Telegram. If you forgot how to use a CLI just ask your bot to deploy it!
Caution: review the findings below before installing.
CautionScan verdict · score 62/100
- Coverage
- full
- Checks run
- Rule-based pattern scan
- Files checked
- 34
- Findings
- 4
- Scanned
- 2026-11-01
Badges are rule-based checks, not guarantees: Safe means our rules found no obvious threat in the code we could read. Review code before installing.
Botlens score · 8 factors
62/100
Each factor is 0, ½ or 1, computed only from catalog fields (scan result, coverage, findings, script files, commit/SHA, author, last seen, install link). A heuristic summary, not a guarantee.
| Scan verdict | 0.5/1 | Caution | |
|---|---|---|---|
| Code coverage | 1/1 | full | |
| Rule findings | 0/1 | 14 matched | |
| No executable scripts | 0/1 | 24 script file(s) of 34 | |
| Pinned source | 1/1 | commit/SHA-256 recorded | |
| Named author | 1/1 | 0xcen | |
| Recently seen | 1/1 | last seen 2026-10-30 | |
| Install path | 0.5/1 | source URL only |
Scan details
- Findings
- Hand review 2026-11-01: downgraded to Caution. Setup downloads and runs scripts/setup.sh from its own repo (README); 'decodes hidden code' is a data-URL image decode, not execution (src/mcp.ts:396-411); POSTs go to Telegram API and the user's Grok Bot webhook (src/telegram-webhook.ts).
- downloads a script and runs it (two-step / inline fetch-exec): "… `WORKER_URL`, then run: curl -fsSL https://raw.githubusercontent.com/0xcen/grambot/main/scripts/setup.sh -o setup.sh bash setup.sh With `MCP_BEARER_T…"
- uploads data to a remote server in test/debounce.test.ts: "…Id }, ...fields }, }; return worker.fetch( new Request(`${BASE}/telegram`, { method: "POST", headers: { "X-Telegram-Bot-Api-…"
- uploads data to a remote server in test/owner.test.ts: "…ecret-Token"] = secret; return worker.fetch( new Request(`${BASE}/telegram`, { method: "POST", headers, body: JSON.stringify({ updat…"
- Content SHA-256
- 6660684aa666a2ca…
- Commit
- 7237f658ca
- Files
- .gitignore
.nvmrc
INSTRUCTIONS.md
LICENSE
README.md
package-lock.json
+28
About
- Author
- 0xcen ↗
- Listed on
- github ↗
- Category (approx.)
- coding
- First seen
- 2026-10-30
- Last seen
- 2026-10-30
- URL
- github.com ↗