The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests verification URLs and codes from the xAI OAuth backend and passes them to the agent for user interaction.
Ingestion points: Data is received via the request_device_code and poll_authorization calls in exports.py.
Boundary markers: None.
Capability inventory: Network requests to localhost and file system writes to the workspace.
Sanitization: None.
[DYNAMIC_EXECUTION]: The script dynamically modifies sys.path to import the core.xai_grok module from /app, /data/workspace/starchild-clawd, or a path defined in the STARCHILD_CLAWD_DIR environment variable.
[COMMAND_EXECUTION]: The skill sends a network request to http://localhost to invoke the /internal/runtime/flush_agent_cache endpoint, ensuring that newly authenticated models are available in the agent's provider list.
[COMMAND_EXECUTION]: The skill uses os.chmod to restrict access to the .xai_oauth_pending.json file to the current user (0o600) and performs atomic file updates using os.replace.

xai-grok-onboarding