His bot advised against a stranger's add-on bot
Someone shared a "bot improver" that other Grok Bot users could add to make their bots better. Before installing it, he asked his own Grok Bot. It advised against it: the add-on was made by another user, not by xAI, and it ran through an outside gateway service that would get to see what his bots were doing. That's sensible caution. A shared bot or plugin can read whatever your agent can read, which may include your email, calendar and saved logins. The fact that it shows up in a marketplace doesn't mean the agent's maker has checked it.
The lesson: Treat add-ons from other users like any app that asks for your passwords: check who made it and where your data goes first.
Copy this prompt
Before I install this bot or plugin: [LINK]. Tell me who made it, whether it's from the official maker, what data and accounts it would be able to see, and whether it sends anything to an outside service. Give me a plain yes or no recommendation and the reason.
Our own prompt, written from what the source describes. We haven't run it ourselves. Text in [BRACKETS] is what you replace.
Watch out for
- An add-on can see what your agent sees. Ask who made it and where it sends data before you install it.
Where this comes from
Original post by @thekhoma on X, Oct 30, 2026. We rewrote it in our own words. Check the original for the full context.
Read the original