Grok Bot 本地连跑 6 个安全工具、24 项检查全过

kvinsi @kv1nsiii原推发布于 2026.10.24

在 X 上打开原推

Grok Bot ran 6 local tools one after another and none of it left the machine. each tool did one narrow job deep-audit → red-team → call-guard → action-log → sandbox → secret-mask the receipts at the end of the run: deep-audit: 214 files, 2 vulns (a sql concat in auth.ts, an old lodash) red-team: a path trick returned /etc/passwd. patched, replayed, blocked call-guard: 2 ok, 1 ask, 2 deny action-log: 23 actions saved, 2 risky ones stopped sandbox: the agent sees ./src and nothing else secret-mask: nothing leaks out 24/24 checks passed. 6/6 caught you don't need a company security rollout for this. it runs next to your code 3 questions to ask about your own agent setup: 1/ can it read ~/.ssh or ~/.aws? 2/ can it call out to the network without asking you? 3/ do your keys ever reach the model in plain text? if you can't answer all three, hand Grok Bot this brief and read what it finds: "Audit the security of this one project, fully on-device with nothing uploaded. Run six tools in order: a deep code audit, an attack on my own app on localhost, a guard for every agent call, an action log that blocks risky moves, a sandbox for the agent, and a masker for secrets before they reach the model. Show me the plan first and wait for my OK. Start by only logging what you would block, then turn blocking on when I say so" demo run on screen, sample data the full breakdown is in the piece below ↓

这条是引用着另一条写的：x.com/kv1nsiii/status/2113703026120884264