Grok Bot Skills & Routines

Skills

• What goes in one: steps, decision rules, expected output, and safety boundaries.
• Where they live: a private library shared across all your Bots. Manage it at Marketplace → Your plugins → Manage plugins and skills.
• How to invoke: type / in the composer to pick a saved skill. If one is missing, check that it's listed under Private skills in Marketplace.
• Teach by demonstration: where available, record up to ten minutes of browser work (no audio). The Bot turns it into a draft skill. You then add the parts a recording can't show: decision rules, failure handling, and approval boundaries.

Write it yourself — copy-paste prompt

The safest skill is one you built from your own workflow. Paste this to a Bot after doing the task once together:

Turn the task we just did into a reusable skill. Write it as:
1. Purpose — one sentence, one job.
2. Inputs — what I will give you each time, and where it comes from.
3. Steps — numbered, in order. Be exact where the task is mechanical;
   describe what "good" looks like where it needs judgment.
4. Decision rules — the if/then choices you made and why.
5. Failure handling — what to do when a site blocks you, data is missing,
   or a login expires. Default: stop and tell me.
6. Approval boundary — never send, purchase, delete, publish, or change
   account settings without asking me first.
7. Output — the exact format, plus a short checklist of what you verified.
Show me the draft before saving it.

Routines

Creating one

Ask the Bot for it in plain language ("create a routine that runs this skill at 6:45am and 6:45pm Eastern"), then check that it recorded all six things the docs ask for: the owning Bot, the schedule and time zone, the input source, the expected result, the approval boundary, and what to do when data is missing.

Managing routines

Open the Bot → View conversation details → Routines. From there you can enable or pause, test run, edit the schedule, inspect history, or delete.

• Limits: up to 50 routines per Bot, and the app keeps the 20 most recent run records per routine. Export anything you need to keep longer.
• Test runs do real work. Use safe inputs, such as a test inbox or a draft-only mode.
• Auto-pause: a routine can pause itself after a long period without a response from you.

Webhook routines, end to end

Pattern from this build, which gives a Bot its own inbox:

1. Ask the Bot to create a routine whose trigger is a webhook. Open the routine and copy the webhook address and key.
2. In the sending service (the build used AgentMail), add the URL as an endpoint, subscribe it to the events you want (message received), and add a custom header:

Authorization: Bearer <key from the routine>

3. If the sender serves several inboxes or sources, filter on the sender side so each Bot wakes only for its own traffic. AgentMail supports a JavaScript transformation on the endpoint for this.
4. Send a test event and watch the Bot start working.

To trigger it from your own code:

curl -X POST "$GROK_BOT_WEBHOOK_URL" \
  -H "Authorization: Bearer $GROK_BOT_WEBHOOK_KEY" \
  -H "Content-Type: application/json" \
  -d '{"task":"Summarise the new support tickets from the last hour"}'

The payload shape is up to you. The Bot reads whatever arrives, so tell it in the routine what to expect. Keep the URL and key in environment variables, never in a repo.

Approval boundaries every routine should have

xAI's guidance, and ours: require approval for sending, purchasing, deleting, publishing, or changing production systems. A routine runs while you're not watching, and it inherits every login on the shared computer. The boundary is what keeps a misread email from turning into an action.