[rgarcia]

Summary

The kernel-mcp skill documents Kernel's hosted MCP server, so it shouldn't live inside the Grok plugin. This moves it to skills/kernel-mcp/ so other consumers can use it: the MCP server will serve it through the MCP Skills extension (kernel/kernel-mcp-server#260), and npx skills add kernel/skills now picks it up because skills/ is one of the CLI's default search dirs.

• skills/kernel-mcp/SKILL.md is now the source of truth.
• grok/skills/kernel-mcp/ is a committed copy. A symlink wouldn't work: the xAI marketplace catalog resolves skill paths and drops anything outside the plugin root (contained() in plugin_catalog.py).
• scripts/sync-plugin-skills.sh refreshes the copy, and --check fails when it's stale. A new workflow runs the check on PRs and on main.
• Adds a "Kernel MCP" grouping to skills.sh.json and bumps the Grok plugin to 1.1.1.

Skill text changes

• Rewrote the one Grok-specific line ("grok opens a browser window…") so it works for any host. The skill now matches the copy in kernel/cursor-plugin, apart from the next change.
• The MCP server has a test that keeps everything it advertises free of access-evasion wording (stealth, bot detection, scraping). Since the server will now serve this skill, the description and the first workflow use the server's own wording instead: "site-compatibility settings, only on sites the user is authorized to access." The stealth API field is still named in code.

Testing

• scripts/sync-plugin-skills.sh --check passes, and it fails after hand-editing the copy.
• npx skills add <checkout> --list lists kernel-mcp exactly once. Before this change it wasn't listed.
• Not tested in Grok Build itself. The marketplace entry needs to be repinned to the merge commit separately.

Reviewed with sol-loop: 1 round with openai-codex/gpt-6.1-sol on extra-high reasoning. Sol verdict: approved.

[rgarcia]

Picked masnwilliams to review these related PRs (#49, kernel/kernel-mcp-server#260): touched the changed code in skills; 10 pending

[masnwilliams]

lgtm. one copy plus a CI check is about as small as this can get: the Grok catalog drops paths outside the plugin root, and npx skills only finds skills/ or manifest-declared dirs. a few non-blocking notes:

worth fixing before merge

• grok/README.md: the ../skills/kernel-mcp link points outside the plugin root, so it dangles once the plugin is installed. that's the same reason a symlink doesn't work. the "run scripts/sync-plugin-skills.sh" note is also for maintainers, not plugin users. i'd drop that sentence; the script header and the CI error already cover it.

nice to have, scripts/sync-plugin-skills.sh

• update mode runs rm -rf "$dst" before checking that $src exists. if the source is renamed, the plugin copy gets deleted and then cp fails.
• any argument other than --check (e.g. --chek) silently runs update mode.
• --check sends the diff to /dev/null, so a red CI run doesn't show what drifted.
• every source is skills/<name>, so listing only the destinations and deriving the source with basename removes the src:dst parsing.

this covers all four (tested: clean check exits 0, a stale copy exits 1 and prints the diff, a typo exits 2, a missing source exits 1 and leaves the copy alone):

-# source skill dir -> plugin copy
+# plugin copies of skills/<name>
 copies=(
-  "skills/kernel-mcp:grok/skills/kernel-mcp"
+  grok/skills/kernel-mcp
 )
 
-check=false
-[[ "${1:-}" == "--check" ]] && check=true
+case "${1:-}" in
+  "") check=false ;;
+  --check) check=true ;;
+  *) echo "usage: $0 [--check]" >&2; exit 2 ;;
+esac
 
 status=0
-for pair in "${copies[@]}"; do
-  src="${pair%%:*}"
-  dst="${pair#*:}"
+for dst in "${copies[@]}"; do
+  src="skills/$(basename "$dst")"
+  [[ -d $src ]] || { echo "$src does not exist" >&2; exit 1; }
   if $check; then
-    if ! diff -r "$src" "$dst" >/dev/null 2>&1; then
+    if ! diff -ru "$src" "$dst" >&2; then

follow-up

• kernel/cursor-plugin has a third copy of this skill that nothing checks, and it already has the old stealth/scrape wording. it could pin a kernel/skills commit and check against it, the way kernel-mcp-server#260 does.
• grok/.grok-plugin/plugin.json and the grok/README.md intro still say "stealth chromium sessions". fine if that's intentional.