Skip to content
MeloSkill

Bot

Box Inspector: add the template or paste a checklist

Ops

Links a public Box Inspector template that reviews a bot share before you add it, and keeps a short MeloSkill paste checklist for the same pre-install review.

Prefer Add to Grok Bot below for the full template. Or paste the short checklist, add your own details, then you review and send yourself.

Recommended

Add to Grok Bot

Opens the public share page. Read what it includes, then choose Add to Grok Bot. MeloSkill does not store or run that bot for you.

Add to Grok Bot

By @SuddenlyJon . Read skills and routines on the share before you add. MeloSkill is not affiliated with xAI or the sharer.

What it includes

  • Role instructions for inspecting a public bot share before you add it
  • A workflow that walks the share text and flags risky asks
  • Confirm the exact skills and routines on the public share page before you add

Before you install

  • Open the share and read every skill and routine listed there
  • Keep any routines paused until you trust a manual run
  • Reconnect apps yourself; creator logins and chat history do not travel
  • Never paste API keys, passwords, or one-time codes into chat
  • MeloSkill does not run this share for you and does not promise it is safe

Or paste text

Paste a short checklist

Use this if you would rather not import a template. Short instructions you copy yourself, not the full bot.

Paste checklist 
You review a bot or plugin the human is about to install. You do not install it.

They paste the description, the permission list, and any install steps. You answer:
1. What data it would read (mail, files, social accounts, a repo).
2. What it could change or send.
3. Whether it asks for a key, a password, or a token in chat. If yes, say stop.
4. A yes/no: install, install with the plugin off, or do not install.
5. If they skip it: which MeloSkill page covers the same job with notes they paste.

You are doing a text review, not a security audit. Say that in the first line.
Never ask them to paste a live key so you can "test" it.

What this does not do

Applies whether you import the public template or paste the short checklist.

It does not store or run the public bot for you, scan a binary, guarantee a plugin is safe, or replace reading the permissions yourself.

How often

If you use the short paste checklist below. Timed jobs on the public template are set on its own page after you add it.

Each day

  • Run the checklist once, before you click install. Not after.

Each week

  • Re-read permissions on any plugin you connected this week.
  • Remove anything you cannot explain.

Plugins

For the paste checklist. Apps the public template may ask for are listed under What it includes; connect those only after you add the bot.

None. The point is to decide before a plugin is connected.

If you cannot get the permission list, do not install. Use the version that needs only notes you paste.

Risks and limits

Extra cautions for this job. The Before you install list above covers what to check before you add the bot.

  • A text checklist is not a security audit. Pass and Review labels on skill pages are a text search too.
  • Never paste live keys to “see if it works.”

FAQ

Will this catch malware?

No. It makes you read permissions and refuse keys in chat. It is not a scanner and not an audit.

Do I need a plugin for this check?

No. The point is to decide before anything is connected. If you cannot see the permission list, do not install.

Is a Pass or Review label on a skill page the same check?

No. Those labels are a text search of a SKILL.md file, described on Methodology. This page is a checklist you run yourself before you connect a bot.

Can I paste a live key to test the bot?

No. Never paste live keys, tokens, or passwords into the chat to see if it works.

Ops bots

All Ops bots

Also