According to God of Prompt, Grok docs warn bots are not a security boundary as a GitHub scanner targets agents with filesystem and browser access.