Is AutoGrok - Auto send Grok prompts and download images/videos safe?
AutoGrok sends the signed-in Grok account email to Google Analytics and uploads selected image-reference files to imgbb.
On Grok pages, AutoGrok reads account details from page bootstrap data and includes the signed-in email in Google Analytics measurement events. When a user selects image-reference files for supported workflows, it uploads those files to imgbb with the Grok account email attached.
Who publishes itAutojourney - 4 other listings from the same operator, 2 of them carrying a finding
Autojourney - 4 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
4 other listings published from this account, 22k+ users between them. 2 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Selected Grok image files and account email upload to imgbb.com
When you select an image for a Grok image-reference workflow, the extension uploads the file to imgbb.com.
The upload can include the signed-in Grok account email, combining image data with account information.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user selects an image for a Grok image-reference workflow.
The extension uploads the selected image and can include the signed-in Grok account email.
- Grok account emailuser@example.com (illustrative)
Links the upload to the signed-in Grok account identified from page content.
- Selected image filereference-image.png (illustrative)
Contains the image the user chose for the reference workflow.
Where it sends data
Destinations our analysis observed AutoGrok - Auto send Grok prompts and download images/videos contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
AutoGrok - Auto send Grok prompts and download images/videos sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- api.imgbb.com
AutoGrok - Auto send Grok prompts and download images/videos sends data to api.imgbb.com. 6 other extensions we have analysed send data here.