method

corpus

the corpus is Grok Bot charters published as plain text in public GitHub repositories, snapshot 2026-09-04. the strict corpus is the source set minus 3 repositories that are not the unit of analysis (skill libraries and directories of "set up a new bot for me" setup prompts). this is not a census of public Grok Bot templates. install-link directories are excluded because their configuration text lives on x.ai, which this project never fetches.

strict corpus: 1596 charters from 86 repositories, inclusion 40 to 3000 words, english only, one charter = one bot role description a person could paste into a bot profile. full corpus (the 3 excluded repositories added back) is 2282 charters and is used only as a robustness line in the report, never on the check page.

every source is pinned to a commit sha resolved on the snapshot date and fetched as a tarball by that sha. api.github.com and x.ai were never contacted. all charters are english: the detectors, their token lists and the hand labels are english only, and results on any other language are not reliable.

source set: 89 repositories were read in total: the curated lists' own picks plus 253 repositories linked from the two discovery lists, of which 171 were excluded by the standing exclusion classes (code tools, connectors, bridges, installers, link directories, documentation), 8 could not be fetched, and 74 were fetched and put through the same inclusion test. every repository is pinned to a commit sha. sampling frame: charters published in repositories linked from two curated awesome-lists. no code search was used.

sources

the eight rules and the publication gate

each rule is a pure function over the normalized english charter text, the same code that runs in your browser on the check page. every rule was checked against 60 charters labelled by hand, blind, before the detector output was read. two gates: gate a is three-way agreement (true / false / unclear), gate b is agreement on true against not-true, both at 0.85. rows: 1 clears gate a, corpus-wide counts publishable. 2 fails a, clears b, only the corpus true count is publishable. 3 fails both but never invents a true, so the corpus true count is a lower bound. 4 fails everything, sample only. only rows 1 to 3 appear on the check page.

gate values are shown to three places here and unrounded in numbers.json. sample intervals are wilson 95 percent.

two numbers that are easy to misread

secret shapes: 0 of 1596 charters carry one. this corpus is curated public repositories where github's push protection and secret scanning make a live key close to impossible, so the zero says the search was on the wrong surface, not that nobody leaks. nothing is claimed about share links, which this project never reads.

part of that zero is the detector, not only the surface. the shapes the audit ran with required an unbroken alphanumeric tail after the prefix and the text layer they ran on dropped underscores, so keys of the shape sk-ant-api03-..., sk-proj-... and ghp_... were never catchable. on 2026-09-05 the shapes were widened: an api key is now sk- followed by up to 40 characters of letters, digits, hyphens or underscores and then at least 16 alphanumerics, a github token is ghp_, gho_, ghu_, ghs_ or ghr_ plus 20 alphanumerics or github_pat_ plus 20 characters, the slack shape also takes xoxe-, and the text layer keeps underscores inside a token. an email address is no longer counted as a secret: the check page reports it separately as something to look at before sharing. the corpus was re-scanned for this rule only, with every other rule's labels verified byte-identical: 0 of 1596 charters carried a secret shape before, 0 of 1596 after (1 carry an email address). the published numbers are unchanged.

injection: the number reported is the silence, 1302 of 1596 charters say nothing either way about whether content the bot reads can give it orders. the detector found 0 charters of 1596 that tell the bot to obey such content, and 0 of the 60 hand-labelled charters; an earlier hand-labelled sample on the wider corpus found an exposed charter the detector had missed, so a detector zero here is a floor, not a fact.

limits

• this reads text, not behaviour. a charter with an approval line can still be run without one, and one without it can be run carefully.
• the corpus is english charters published in public github repositories on 2026-09-04, not a census of public templates. one repository supplies 0.164 of the strict corpus and one near-duplicate family (5-gram jaccard at or above 0.50) covers 205 of 1596 charters, so every rate partly describes them.
• the rules that sit in row 4 (Approval, Memory, Boundary, Finished, Tools) are reported only from the hand-labelled sample of 60. they are not on the check page, whatever the headline of the accompanying article rests on.
• the detectors are regular expressions over english text. a clause phrased in a way the corpus never used will be missed, and a charter in another language will be misread, which is why the check page leads with what your charter already does and never scores it.

reproduce

the full pipeline (python, standard library only), the frozen numbers with their sha256 hashes, the blind hand labels, the decision log and the parity report between the browser engine and the python engine exist as a working folder that has not been published at the time of writing, so this page cannot link you to it. what you can check here: the source table above names every repository and commit, so the corpus can be rebuilt from those pins, and rules.js on this page is the exact engine, generated from the python one. the browser engine agreed with the python engine on every one of the 12768 frozen labels.