`ptr`, `addr` and `cast` are the only ways to introduce unsafety, as I understand it. You have to run three greps, but you can definitely grep.
Finding unsafe constructs in Nim code is not that hard, at least at the same level of accuracy as `grep unsafe *.rs` (e.g. inside comments & strings, etc.).
To evaluate the power of this general line of argument, consider -- if Nim shipped with a `find-unsafe` source-level search utility, how much would this change your mind?