Grok Bot template scan
Use when scanning a public Grok Bot template (x.ai/bot share URL or pasted config) or a local roster agent for CLEAN / WARN / BLOCK-recommended before any install. Covers six surfaces, inventory, fetch lock, pinned hosts, secret redaction, unexpected keys, second-order fetches, truncation honesty, hash diff, proceed notebook. Every verdict must explain why. Never add or install.
