Is their code posted somewhere like Github? If it's not decentralized and open-sourced I don't think we can trust that bot from getting your passphrase then throwing it up to the one who created it.