Headline numbers
| Listings indexed | 31,604 |
| Removed as not-a-bot (posts, handles) | 230 |
| Marked Risky, hidden | 584 |
| Listed | 30,790 |
| Safe | 10,837 |
| Caution | 538 |
| Unscanned | 19,415 |
How much could we actually read?
Of 30,790 listed entries, we read the full code for 11,072, only a public description for 7,018, and nothing at all for 12,562. The biggest finding is not a threat. It is how much of this ecosystem cannot be inspected.
Why things got a Caution badge
| reads environment variables (where API keys live) | 176 |
| public description only | 165 |
| Contains ads/promo (affiliate, course or sponsor links) | 135 |
| asks for overly broad permissions | 78 |
| spawns shell commands or evaluates code | 67 |
| hides actions from the owner (tool-poisoning hallmark) | 30 |
Where listings come from (top 8)
| templatesgrokbot.com | 10,432 |
| grokdir.com | 7,841 |
| grokbot-templates.com | 5,827 |
| github:RongleCat/awesome-grok-bot | 2,014 |
| grokbot.dev | 1,895 |
| grokmarket.io | 713 |
| grokindex.dev | 682 |
| meetmybot.ai | 467 |
By category
Method
Heuristic static scan of instructions and code for credential access, remote upload, shell execution, remote install scripts, unapproved sending, broad permissions and promotional links. Badges are heuristic, not guarantees. Details of Risky listings are withheld in this draft.
Read next
Browse by category: Research · Coding & Dev · Design & Video · Writing & Content · Productivity · Finance & Crypto