grok-bot-box-image — local rebuild of Grok Bot box base

Dockerfile and scripts to rebuild a Grok Bot–style local box base image (desktop, browser, toolchains) from black-box observations of 0.18.

View source ↗

SafeScan verdict · score 56/100

Coverage: full
Checks run: Rule-based pattern scan
Files checked: 52
Findings: 4
Scanned: 2026-11-01

Badges are rule-based checks, not guarantees: Safe means our rules found no obvious threat in the code we could read. Review code before installing.

View source ↗

Botlens score · 8 factors

56/100

Each factor is 0, ½ or 1, computed only from catalog fields (scan result, coverage, findings, script files, commit/SHA, author, last seen, install link). A heuristic summary, not a guarantee.

Scan verdict	1/1	Safe
Code coverage	1/1	full
Rule findings	0/1	23 matched
No executable scripts	0/1	31 script file(s) of 52
Pinned source	1/1	commit/SHA-256 recorded
Named author	0/1	unknown
Recently seen	1/1	last seen 2026-10-30
Install path	0.5/1	source URL only

Scan details

Findings

Hand review 2026-11-01: Credential-path hits are a scanner that blocks secrets from being published (scripts/scan-image-archive.py:35, tests/test-publication-safety.py); Dockerfile pins official binaries by SHA-256 (box-image/Dockerfile:79).
downloads and runs a remote script (stealer installer pattern): "…GETARCH 选择文件与官方 SHA-256。 # 用 `curl | bash` 那种安装脚本会装进 $HOME、且每次构建拉到的版本都不…"
asks for overly broad permissions: "…uild 就把换掉的二进制装进这台持有全机登录态、还有免密 sudo 的容器。 # 值取自官方清单(bun 的 SHASUMS2…"
link has a template placeholder that fills in user data: https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-$

Content SHA-256

c46eab81ee61db02…

Commit

5c681e6609

Files

.dockerignore
.gitignore
.gitleaks-image.toml
README.md
box-image/Dockerfile
box-image/bin/box-chrome
+46

About

Author: 2217173240 ↗
Listed on: github:RongleCat/awesome-grok-bot ↗
Category (approx.): design
First seen: 2026-10-30
Last seen: 2026-10-30
URL: github.com ↗

Get the Botlens skill