{"found":true,"collection":"patterns","library_url":"https://www.grokbotdb.com/library/pat.post-to-bot-is-untrusted-input","generated":"2026-09-06T05:32:11Z","citation":["Quote the record id and its source_url (or provenance if there is no URL).","Include last_verified or observed_at when present. Do not present an old date as current.","If tier is community and confidence is low, say so. Do not launder it into a fact.","If the database does not hold the answer, say that. Do not invent Grok Bot product claims.","Contradictions are data: when conflicts_with is present, report both records rather than picking a favourite.","Deprecated and removed records stay visible. They are history, not current guidance."],"record":{"id":"pat.post-to-bot-is-untrusted-input","name":"Turning a public post into a Bot is an injection surface","category":"safety","problem":"A popular workflow is to paste a useful public post into a Bot and ask it to build the capability described. The post is untrusted text and the Bot holds your credentials.","technique":"Treat the post as data. Have the Bot summarise what capability it would add and what permissions it would need, in its own words, and approve that summary rather than letting it act on the text directly.","why_it_works":"It puts a human between text written by a stranger and a Bot that can act in your authenticated sessions, which is precisely the gap prompt injection targets.","when_to_use":"Every time a post, README, template or feed item is used as a specification.","when_not_to":"Never skip it. The cost is one extra message.","manual_ref":"5.4","evidence":"inferred","source_url":"https://x.com/ericosiu/status/2095207617610256720","related":["pat.job-trigger-authority"],"confidence":"medium","first_seen":"2026-09-03","last_verified":"2026-09-05"}}