EXECUTION RUNTIME: GROK BOT LINUX SANDBOX (/workspace) LIVE TEMPLATES: 15 AVAILABLE (FREE + $19, $29, $39 & $49 · CARD) · ZERO SUBSCRIPTIONS PRIVACY: LOCAL CREDENTIAL VAULT · ZERO DATA EXFILTRATION
llms.txt ↗ Agent Catalog Install Free Utility ↗
Install Free Utility →
DETERMINISTIC GROK BOT SKILL CATALOG

OSINT, Industrial Research & Physical Robotics Agents

15 live automations available now (1 free web extractor, 3 $19 templates: corporate & competitor deep-dive analyst, domain, TLS & email auth hygiene auditor, and MCP server & tool-permission security auditor, 6 $29 templates: security auditor, SEC & patent watchdog digest, SEC EDGAR supply chain & counterparty mapper, social hub publisher, dependency vulnerability triage, and 3D print farm & slicer queue ops, 4 $39 templates: the Agent Council multi-model debate and pair-architect collaborator, the mill cert matcher receiving-inspection cross-check, the RFQ flowdown triage quality-clause screen, and the FAI results reconciler balloon-list screen, and 1 $49 template: the humanoid & fleet telemetry inspector). Every template enforces explicit refusal boundaries inside /workspace.

Available Now — Instant License & Grok Bot Install (15)

● LIVE · FREE UTILITY getting-started + web-extractor

Web & API Text Extractor

$0 Free Forever · 10/UTC Day + Local Fallback

Self-onboarding web and documentation text extractor for Grok Bot (included skills: getting-started + web-extractor). Provisions its own API key on Turn 1 into a 0600 env file in /workspace and provides 10 free cloud text extractions per UTC day plus automatic local fallback.

  • Turn-1 Auto-Provisioning (getting-started): Registers an agent key (wck_...) via /api/v1/agents/register, stores it locally with chmod 600 permissions, and runs a live example.com verification check.
  • 10 Cloud Extractions / UTC Day (web-extractor): Server-side static HTTP + BeautifulSoup readable text extraction on the hosted text-extraction API (POST /api/v1/scrape) with X-Quota-Limit: 10 and X-Quota-Remaining headers.
  • Local Fallback & SSRF Guardrails: Automatically falls back to local curl -sL + Python HTML-to-text in /workspace and rejects loopback, RFC1918, and cloud metadata IPs.
Refusal Boundary: No false headless-JS rendering claims; never prints secret API keys in chat; rejects private/loopback/metadata SSRF targets with HTTP 400; format: "html" and format: "json" are paid per-call modes on the registry; this free utility uses format: "text" (10/day free) and never invokes paid modes without explicit user confirmation.
Install Free in Grok Bot Full Spec & Sample Page →
● LIVE · $29 · CARD auditor-setup + bot-skill-auditor

Bot & Skill Security Auditor

$29 card · One-Time License

See every network call, credential read, and shell command in a third-party skill, with line numbers, before you run it. Static, read-only inspector for Grok Bot templates, SKILL.md files & GitHub repos via the read-only audit-prep helper.

  • Line-Cited 5-Bucket Audit: Quotes verbatim prompt-bypass strings (L14), SSH/.env secret reads & cron persistence (L29), outbound webhooks/MCPs (L31), obfuscation, and local machine escalation.
  • Deterministic Prep Helper: Wraps untrusted files in random <untrusted_artifact_<16-hex>> tags, enforces 50-file / 100 KB / 250 KB caps, pins GitHub refs to 40-char SHAs, and logs Files Audited & Files Skipped.
  • Transparent Scope Limits: Flags only what exists in the files at audit time—never claims a skill is "safe" and explicitly states what static analysis cannot catch (runtime-fetched payloads, delayed API responses, time-bombs).
Refusal Boundary: Never executes audited code, never curls embedded URLs, never reads the 0600 env file in /workspace into context, and never issues a "safe/pass" badge or numeric grade.
Full Spec & Sample Page →
● LIVE · $19 · CARD company-deep-dive-setup + company-deep-dive

Company & Competitor Deep-Dive Analyst

$19 card · One-Time License

Pull a 7-section primary-source corporate and competitor dossier—SEC EDGAR filings, patent disclosures, RDAP domain records, and a side-by-side competitor matrix—with exact accession numbers and UTC timestamps. Deterministic read-only OSINT analyst via the read-only primary-source fetch helper.

  • 7-Section Cited Dossier (REPORT.md): Compiles Entity Snapshot (CIK, SIC, state, FYE), SEC EDGAR 10-K/10-Q/8-K/Form D table, SEC EFTS + USPTO PatentsView IP footprint, RDAP domain records, and an up-to-5-entity Competitor Matrix.
  • Hardened Stdlib Fetch Helper: Enforces HTTPS-only DNS-pinned SSRF protection, SEC-compliant User-Agent (<= 5 req/s), 40-request / 200 KB doc caps, and wraps all external data in random 128-bit <untrusted_data_<32-hex>> tags.
  • Transparent Public-Filing Scope: Prepends verbatim SCOPE_NOTE.txt and explicitly discloses what public registries do not cover (private subsidiaries, unfiled contracts, trade secrets, or real-time financials).
Refusal Boundary: Never outputs stock buy/sell/hold ratings, valuation multiples, price targets, or legal infringement conclusions; pauses on ambiguous company names (AMBIGUOUS_ENTITY); excludes individual non-corporate filers.
Full Spec & Sample Page →
● LIVE · $29 · CARD sec-patent-watchdog-setup + sec-patent-watchdog

SEC & Patent Watchdog Digest

$29 card · One-Time License

Know about new SEC filings and patent publications for your watchlist the day they land—and hear nothing when they don't. Scheduled delta monitor for up to 10 tickers/CIKs with a stateful baseline and diff engine.

  • SEC EDGAR + USPTO Delta Tracking: Watches 10-K, 10-Q, 8-K, Form 4, 13F-HR, and S-1 filings plus USPTO patent/IP publications for up to 10 tickers/CIKs.
  • Stateful Baseline & Diff Engine: Persists a state.json baseline of last-seen accession numbers and writes DELTA_SUMMARY.json + DIGEST_<timestamp>.md only for what changed.
  • Native Grok Bot Scheduling: Registers an UpdateRoutine that stays quiet when zero new filings land.
Preview sample delta digest (NVDA & AMD) 
# SEC & Patent Watchdog Delta Digest
- Generated At (UTC): 2026-10-25T13:00:00Z
- Watchlist (2/10): NVDA (CIK 0001045810), AMD (CIK 0000002488)
- Baseline: state.json (last checked 2026-10-24T13:00:00Z)
- Delta: 3 new SEC filings, 1 new patent publication

## NVDA — NVIDIA CORP
| Form | Filed | Accession Number | Items / Document |
| :--- | :--- | :--- | :--- |
| 8-K | 2026-10-24 | 0001045810-26-000212 | Item 5.02 · nvda-20261022.htm |
| Form 4 | 2026-10-23 | 0001045810-26-000209 | Insider transaction · xslF345X05/form4.xml |

## AMD — ADVANCED MICRO DEVICES INC
| Form | Filed | Accession Number | Items / Document |
| :--- | :--- | :--- | :--- |
| 13F-HR | 2026-10-24 | 0000002488-26-000118 | Institutional holdings · primary_doc.xml |

## Patent / IP Delta (USPTO)
- AMD: 1 new publication since baseline (see DELTA_SUMMARY.json for publication ID and URL)

Outputs: DELTA_SUMMARY.json, DIGEST_20261025T130000Z.md
If zero new filings land, no digest is written and no message is sent.
Refusal Boundary: Never sends empty "no change" filler alerts; never bypasses SEC EDGAR rate limits or User-Agent identification; never connects to brokerage APIs or gives buy/sell/hold advice.
Full Spec & Sample Page →
● AVAILABLE NOW · $29 · card social-hub-publisher-setup + social-hub-publisher

Social Hub Publisher

$29 card · 3 Rebinds

Write once, approve once, publish everywhere. Queue one announcement and publish it to X, Discord, Bluesky and Telegram without pasting it four times or sending something you did not approve.

  • Gate 1 linter: per-channel length (X weights URLs as 23), link-domain allowlist, banned terms, hashtag/mention caps, duplicate detection.
  • approve HMAC-SHA256 signs the exact text with an expiry; Gate 2 in the dispatcher refuses edited, expired or unsigned items.
  • X: free 1-click Web Intent links by default. Optional API mode uses 2026 pay-per-use pricing: $0.015 per plain post, $0.20 per post that contains a link.
Full Spec & Sample Page →
● AVAILABLE NOW · $29 · card dependency-vuln-triage-setup + dependency-vuln-triage

Dependency Vulnerability Triage

$29 card · 3 Rebinds

Fix what is being exploited first. Stop reading 59 advisories in severity order.

  • Parses package-lock.json (v1-v3), yarn.lock, Pipfile.lock, poetry.lock, pinned requirements.txt, Cargo.lock and go.sum.
  • Batch queries OSV.dev, merges GHSA/PYSEC/CVE aliases into one advisory, then adds FIRST EPSS v1 scores and CISA KEV listings.
  • Buckets: KEV_ACTIVE_EXPLOIT, HIGH_EPSS_URGENT (default threshold 0.10), PATCH_AVAILABLE, LOW_PRIORITY_MONITOR, plus a per-package upgrade plan.
Full Spec & Sample Page →
● LIVE NOW · $19 · card domain-infra-hygiene-setup + domain-infra-hygiene

Domain, TLS & Email Auth Infrastructure Hygiene Auditor

$19 card · 3 Rebinds

Find the expiring cert, the spoofable domain and the dangling CNAME before someone else does. One read-only pass over DNS, DNSSEC, TLS, email auth, HTTPS headers and CT logs for domains you own.

  • DNSSEC validated via the resolver AD bit; TLS chain, SAN, protocol, expiry windows and live issuer cross-checked against CAA.
  • SPF expanded recursively against the RFC 7208 10-lookup limit, plus DMARC, DKIM key size, MTA-STS, TLS-RPT and null-MX checks for no-mail domains.
  • HSTS/CSP/header audit, dangling-CNAME takeover fingerprints, Certificate Transparency, copy-paste DNS / Nginx / Vercel / Netlify fixes, and --state --delta monitoring.
Full Spec & Sample Audit →
● LIVE NOW · $39 · card agent-council-setup + agent-council

Agent Council — Multi-Model Swarm Debate & Pair-Architect Collaborator

$39 card · One-Time License

Put 2–6 models on one design question, patch or diff and get the consensus, the minority report and a verdict. Orchestration & DevOps / Coding & Security: works out of the box with local claude personas, plus codex, gemini, aider and BYOK OpenAI, Anthropic, xAI/Grok, Gemini, OpenRouter, DeepSeek and Ollama seats.

  • 4 modes: blind-then-anonymized deliberate, Driver + Navigator pair, rubric-graded compete, and deduplicated CRITICAL..INFO review.
  • Model output ceilings and high reasoning effort, with token savings from line-range --files / --git-diff slices, secret redaction, delta-only rounds and early stop.
  • --seat-timeout, --total-deadline, --max-cost-usd, session steering (--status, --inject, --pause, --resume) and a self-contained HTML council viewer.
Full Spec & Sample Council →
● LIVE NOW · $19 · card mcp-config-auditor-setup + mcp-config-auditor

MCP Server & Tool-Permission Security Auditor

$19 card · One-Time License

Find the leaked key, the unpinned package and the poisoned tool before your agent runs them. Coding & Security / MCP & Agent Hygiene: one read-only pass over your Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Cline and Zed MCP configs plus tools/list snapshots, with no network requests.

  • 5 buckets: SEC_* secrets (always [REDACTED:...]), CMD_*/FS_*/DOCKER_*/DB_* exposure, SUP_* supply chain, NET_* transport and TOOL_* poisoning.
  • Flags curl | sh, --dangerously-skip-permissions, autoApprove, ~/.ssh mounts, npx -y / @latest, typosquats, http:// remotes and <IMPORTANT> injections.
  • Copy-paste hardened mcpServers configs and --state --delta rug-pull alerts (TOOL_DESC_CHANGED, TOOL_SCHEMA_CHANGED).
Full Spec & Sample Audit →
● AVAILABLE NOW · PHASE 2 LIVE print-farm-ops

3D Print Farm & Slicer Queue Ops

$29 One-time USD · card

Catch the wrong-temperature plate, the empty spool and the money-losing SKU before the printers run. Robotics & Manufacturing: one offline, read-only pass over your OrcaSlicer, Bambu Studio and PrusaSlicer .3mf / .gcode files, spool ledger, SKU table and printer list, plus a scheduled multi-printer production queue.

  • 4 buckets: slicer thermal/mechanical safety (TEMP_MATERIAL_MISMATCH, ABRASIVE_FILAMENT_BRASS_NOZZLE, STRUCTURAL_UNDER_WALLED), spool and drying hygiene, per-part unit economics and SKU run-rate scheduling.
  • Prices every part (filament, kWh, machine time, labour) against marketplace fees and a margin target; flags SKU_NEGATIVE_MARGIN and BOM drift between your table and the slice.
  • Greedy earliest-finish queue to CSV from SKU velocity and lead time, plus --state --delta alerts for spool draw-down, supply drops and slicer profile drift.
Full Spec & Sample Audit →
● AVAILABLE NOW · PHASE 1 RELEASE robotics-telemetry-inspector

Humanoid & Fleet Telemetry Inspector

$49 One-time USD · card

Find the overheating knee, the weak cell and the dropped topic before the robot runs again. Robotics & Physical AI: one offline, read-only pass over your actuator logs, 16S LiFePO4 / LiPo BMS exports, ROS 2 bags, PX4 / ArduPilot flight logs, URDF / SDF models and CAN captures, ending in a preventive-maintenance checklist.

  • 4 buckets: actuator, joint and harmonic-drive duty cycles (ACTUATOR_THERMAL_OVERLOAD, JOINT_TORQUE_LIMIT_EXCEEDED, CAN_BUS_FAULT_OR_TIMEOUT), 16S LiFePO4 BMS, ROS 2 bag / TF / QoS integrity, and PX4 / ArduPilot flight readiness.
  • Cross-checks joint limits against your URDF / SDF, flags BMS_CELL_IMBALANCE_DELTA under load and QOS_INCOMPATIBLE_MISMATCH against an expectations file, and writes a NO-GO / ACTION_REQUIRED / SCHEDULE checklist with --maintenance-out.
  • Never commands hardware: no motor, CAN, MAVLink or BMS writes, credentials refused, and --state --delta alerts for cell-spread spikes, thermal drift, SOH steps and topic-rate regressions.
Full Spec & Sample Audit →
● LIVE · $29 · CARD sec-supply-chain-mapper-setup + sec-supply-chain-mapper

SEC EDGAR Supply Chain & Counterparty Mapper

$29 card · One-Time License

Find out who a company really depends on, with the filing quote to prove it. Maps disclosed suppliers, ≥10% major customers, foundry and compute partners, subsidiaries and equity stakes from primary SEC EDGAR filings only.

  • Cited Relationship Edges: supplier, customer, foundry_compute, strategic_partner, subsidiary and equity_stake, each with a verbatim quote of ≤300 characters and an accession number.
  • Inline-XBRL Concentration Scorer: CR-01 to CR-04 customer, supplier and receivables concentration, with Exhibit 21 subsidiaries kept separate.
  • YoY 10-K Diff & 13D/13G Stakes: ADDED / REMOVED / PCT_CHANGED counterparties and EQ-01 equity-stake checks, plus a reproducible audit_sha256.
Refusal Boundary: No quote, no edge: never infers a relationship, never gives buy/sell/hold advice, and fetches only allow-listed sec.gov hosts at ≤5 requests per second.
Full Spec & Sample Page →
● LIVE · $39 mill-cert-matcher-setup + mill-cert-matcher

Mill Cert Matcher

$39 One-Time License

Find the mismatch before the material hits the floor. Cross-checks a mill test certificate against the purchase order and the drawing callout: alloy, temper, spec, size, chemistry and mechanicals, with the source page and line for every flag.

  • Cert / PO / Drawing Match: MCM-MAT-01 and MCM-QTY-01 compare alloy, temper (your equivalences), spec, thickness and quantity.
  • Your Limits, Not Ours: MCM-CHEM-01 and MCM-MECH-01 check chemistry and mechanicals against your own spec-limits library; anything missing or uncertain is a HOLD, never a silent PASS.
  • Traceability Flags: repeated heat numbers, missing signature statement, unparseable cert date and low-confidence fields, with exit codes 0 PASS, 3 HOLD, 4 REJECT.
Refusal Boundary: Screening aid that flags issues for human review. Not a legal, compliance, or material-certification determination. Runs on your machine; no DFARS or ITAR determination.
Full Spec & Example Page →
● LIVE · $39 rfq-flowdown-triage-setup + rfq-flowdown-triage

RFQ Flowdown Triage

$39 One-Time License

Know what the RFQ is asking before you quote. Finds the quality, DFARS/FAR, CUI, export-control, special-process, certification, inspection, counterfeit-parts and record-retention clauses in an RFQ and compares each with your own supplier capability profile, with the source page and line for every clause.

  • Clause Detection: RFT-DFARS-01, RFT-CUI-01, RFT-EXP-01 and RFT-DIST-01 detect that clause text is present; they do not say a clause applies.
  • Your Profile, Not Ours: quality, first-article, special-process, cert and retention clauses are compared with what you told it about your shop; a blank entry is UNKNOWN, never a silent pass.
  • Questions for the Buyer: unknown clause numbers, drawing revision mismatches and scanned PDFs become buyer questions, with exit codes 0 CLEAR, 3 CLARIFY, 4 NO-BID-RISK.
Refusal Boundary: Screening aid that flags issues for human review. Not a legal, export-control, or compliance determination. Runs on your machine; no DFARS, ITAR or EAR compliance claims.
Full Spec & Example Page →
● LIVE · $39 fai-results-reconciler-setup + fai-results-reconciler

FAI Results Reconciler

$39 One-Time License

Catch the mismatches before the first-article package goes out. Matches every characteristic in an FAI balloon list to its inspection result (CSV, XLSX, Calypso-style CSV or PC-DMIS text report) and flags out-of-tolerance, missing, unmatched and duplicate lines, inch/mm conflicts and part or revision mismatches, with the source file and row for every finding.

  • Limits Checked: FAI-TOL-01 compares each measured value with its limits using Decimal maths; a value exactly on a limit passes.
  • Uncertain Is REVIEW: missing results, unit conflicts, attribute results, material-condition modifiers and ambiguous headers are flagged for a person, never a silent pass.
  • Local & Scriptable: files stay on your computer, works offline, exit codes 0 PASS, 3 REVIEW, 4 FAIL.
Refusal Boundary: Screening aid that flags issues for human review. Not a quality sign-off or AS9102 approval. Runs on your machine.
Full Spec & Example Page →
VALUE BUNDLES

Value Bundles — Multi-Bot Packs (One License Key Unlocks All Included Bots)

Buy a pack once (card, Apple Pay or Google Pay) and receive a single wcl_... license code plus an unlisted Grok Bot template link for every bot in the bundle. The same code activates each included bot (up to 3 rebinds).

● 4-BOT BUNDLE · $69 · CARD SAVE $27 vs $96 list

DevSecOps & AI Agent Security Pack

$69 / one-time

Audit agent skills, MCP configs, dependencies and domain infrastructure with one license. One wcl_... license key unlocks every included bot.

SKU: devsecops-ai-security-pack · card checkout · up to 3 rebinds
First Bot Page ↗
● 2-BOT BUNDLE · $59 · CARD SAVE $19 vs $78 list

Physical AI & Manufacturing Ops Pack

$59 / one-time

3D print-farm queue ops plus humanoid and fleet telemetry inspection. One wcl_... license key unlocks every included bot.

SKU: physical-ai-manufacturing-pack · card checkout · up to 3 rebinds
First Bot Page ↗
● 3-BOT BUNDLE · $89 · CARD END-TO-END SEC · EDGAR

Institutional EDGAR Intelligence Pack

$89 / one-time

End-to-end SEC 10-K/10-Q/8-K/13D dossier generation, continuous filing and USPTO patent delta alerts, and cited multi-company supply-chain and concentration mapping. One wcl_... license key unlocks every included bot.

SKU: edgar-intelligence-pack · card checkout · up to 3 rebinds
First Bot Page ↗
DETERMINISTIC EXECUTION ARCHITECTURE

How BotAppStore Templates Work

Every workflow is packaged as an inspectable, plain-text SKILL.md playbook that executes inside your isolated Grok Bot Linux container with strict operational boundaries.

Dual runtime, one license: each wcl_... key activates the Grok Bot template and the standalone CLI.
  1. 1-Click Grok Bot Template (https://x.ai/bot/...)
  2. Standalone Single-File Python 3 CLI (/runtime/<script>.py) — Python 3.10+ standard library only, zero pip install dependencies; runs locally in Cursor, Claude Code, Windsurf, GitHub Actions CI/CD, or any macOS/Linux/Windows terminal, with --json / --markdown output.
STEP 01 · TEMPLATE IMPORT

One-Click Grok Bot Template Import (or Spec Preview)

Live utilities open directly via native https://x.ai/bot/... links with plain-text SKILL.md instructions. Every live template publishes its complete specification, data sources, finding codes, and refusal rules up front.

https://x.ai/bot/k1oyHmw4iS4VBW1U8_3Ol
STEP 02 · ISOLATED SANDBOX

Isolated Linux Container Execution (/workspace)

All scripts, document parsers, and state files run inside your own isolated Grok Bot Linux filesystem (/workspace). API credentials are stored locally with chmod 600 permissions and never echoed in chat.

chmod 600 /workspace/.agent_env # -rw-------
STEP 03 · PRIMARY-SOURCE TELEMETRY

Primary-Source OSINT & Local Telemetry Parsing

OSINT agents query official SEC EDGAR JSON/RSS endpoints, USPTO dockets, and municipal permit portals. Robotics and shop agents parse local .csv, .json, and OrcaSlicer .3mf archives directly on disk.

SEC EDGAR · USPTO · CSV / JSON / .3mf
STEP 04 · DETERMINISTIC GUARDRAILS

Deterministic Refusal Boundaries & Zero Silent Actions

Every skill enforces hard refusal boundaries: zero fabricated filings, zero equity buy/sell advice, zero noisy "no change" alerts, and zero unconfirmed printer G-code or actuator/BMS writes.

READ-ONLY TELEMETRY · ZERO SILENT WRITES

Machine-Readable Agent Catalog & Full Specifications (/llms.txt)

Building an automated workflow or auditing our template specifications? Read the complete plain-text llms.txt catalog listing every template's status, price, required inputs, and refusal boundaries.

PHYSICAL SHOP & WORKSTATION INFRASTRUCTURE

Hardware & Shop Infrastructure Stack

Reference fabrication, open-source slicing, and hardware authentication tools that pair with BotAppStore's 3D print farm and enterprise OSINT workflows. All links point directly to official vendor and repository pages.

ADDITIVE MANUFACTURING Print Farm Hardware

Bambu Lab 3D Printers

High-speed CoreXY enclosed and multi-material 3D printers (X1-Carbon, P1S, A1 series) used in multi-printer production queues for functional PLA-CF, PETG, TPU, and PA-CF parts.

  • ✓ Native .3mf multi-plate project structure compatible with local queue auditing
  • ✓ AMS spool RFID & desiccant tracking workflow compatibility
  • ✓ LAN-only mode support for air-gapped or local-network shop operations
OPEN-SOURCE SLICER 3MF & G-Code Toolchain

OrcaSlicer Open-Source Slicer

Community-driven open-source slicer for FDM 3D printers with granular flow calibration, pressure advance tuning, and inspectable .3mf plate metadata.

  • ✓ Standard ZIP/XML .3mf container format for automated profile verification in /workspace
  • ✓ Precise filament weight (grams) and print duration estimates for BOM costing
  • ✓ Publicly auditable open-source repository on GitHub
FIDO2 / WEBAUTHN SECURITY Workstation Auth

YubiKey Hardware Security Keys

Phishing-resistant FIDO2/WebAuthn and OpenPGP hardware authentication keys (YubiKey 5 Series) for securing developer workstations, GitHub organizations, and cloud infrastructure logins.

  • ✓ Hardware-backed FIDO2 passkeys and SSH key attestation (ed25519-sk)
  • ✓ Physical touch requirement prevents unattended remote session hijacking
  • ✓ No battery or network connectivity required
Direct Vendor Link Policy: Hardware and software links above (marked with data-vendor) point directly to official manufacturer and open-source project URLs with zero tracking parameters. BotAppStore is an independent agent template catalog and is not affiliated with or endorsed by Bambu Lab, OrcaSlicer, or Yubico.
LICENSING, PRIVACY & PRIMARY-SOURCE VERIFICATION

Frequently Asked Questions

How one-time checkout, local /workspace execution, 3-rebind license recovery, and primary-source OSINT refusal boundaries work on BotAppStore.com.

How does one-time licensing work—are there any monthly subscriptions?
Every paid BotAppStore template is a one-time USD license ($19, $29, $39 or $49) with zero recurring monthly subscriptions. Pay by card, Apple Pay or Google Pay through Stripe's hosted checkout. The payment issues a private wcl_... bearer license code immediately after checkout.
Where do BotAppStore skills execute, and do they ever touch my private keys?
All templates execute locally inside your isolated Grok Bot Linux container (/workspace). API keys and license credentials are saved in a 0600 env file in /workspace with chmod 600 permissions (-rw-------) and are never echoed in chat or sent to third-party servers. BotAppStore never asks for seed phrases or private keys.
How do wcl_... license claiming and the 3 workspace-reset rebinds work?
On Turn 1, the setup skill registers or loads your agent key (wck_...) from a 0600 env file in /workspace and calls the license API to bind your wcl_... license code. Each license includes up to 3 automatic workspace-reset rebinds so you can re-claim your license if your Grok Bot /workspace container is ever reset.
What are the primary-source citation rules and refusal boundaries?
Every OSINT and security template enforces deterministic refusal boundaries: SEC EDGAR and USPTO bots cite exact accession numbers, publication IDs, RDAP records, and UTC retrieval timestamps, and never output stock buy/sell/hold advice or legal infringement conclusions. The Bot & Skill Security Auditor cites exact file paths and line numbers and never issues a 'safe/pass' certification badge.
How does the free Web & API Text Extractor work?
The Web & API Text Extractor (https://x.ai/bot/k1oyHmw4iS4VBW1U8_3Ol) is 100% free forever. On Turn 1, it auto-provisions a wck_... key, completes onboarding_v1 + starter_v1, and unlocks 10 free static-HTTP + BeautifulSoup text extractions per UTC day on the hosted text-extraction API (POST /api/v1/scrape) with automatic local curl + Python fallback in /workspace.
Which bots cover prompt injection, due diligence, SBOM, CISA KEV, EPSS, SPF, DMARC and DNSSEC checks?
Bot & Skill Security Auditor flags prompt injection in SKILL.md files and code, and MCP Server & Tool-Permission Security Auditor checks MCP configs. Company Deep-Dive and SEC & Patent Watchdog compile SEC EDGAR and USPTO due diligence. Dependency Vulnerability Triage turns a lockfile (an SBOM-style dependency inventory) into CISA KEV and EPSS prioritized buckets. Domain, TLS & Email Auth Hygiene Auditor checks SPF, DMARC, DKIM and DNSSEC. Agent Council, Print Farm Ops and Robotics Telemetry Inspector cover multi-model debate and physical-ops audits.
Does one license key unlock both the Grok Bot template and a standalone CLI I can run in Cursor or Claude Code?
Yes. Every wcl_... license key unlocks both: (1) the 1-Click Grok Bot template (x.ai/bot/...) and (2) the standalone single-file Python 3 CLI (/runtime/<script>.py). The CLI needs only Python 3.10+ and the standard library, with zero pip install dependencies, and runs locally in Cursor, Claude Code, Windsurf, GitHub Actions CI/CD, or any macOS, Linux or Windows terminal, emitting deterministic --json or --markdown output.