So few.
I would have thought that considering how easy it is to clone a valid site that ALL of these kind of kits would have backdoors. After all if a scammer is unable to replicate a target website and needs tools to do such a thing, he/she/it is unlikely to notice code that sends the data elsewhere.
Sometimes I hate being honest, I could be rich instead. Yes I know riches wouldn't make me happy, but it would be a nice diversion until I got bored with it.