Move kernel-mcp skill to top-level skills/ and copy it into the Grok plugin

.github/workflows/check-plugin-skills.yml

@@ -0,0 +1,16 @@
+name: Check plugin skill copies
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: scripts/sync-plugin-skills.sh --check

README.md

@@ -46,7 +46,7 @@ Install from the Grok Build plugin marketplace:
 /plugin  # search "kernel" and install
 ```
 
-The Grok plugin lives in [`grok/`](grok) and bundles Kernel's hosted MCP server with a skill for using its tools.
+The Grok plugin lives in [`grok/`](grok) and bundles Kernel's hosted MCP server with the [`kernel-mcp`](skills/kernel-mcp) skill for using its tools.
 
 ### Any Agent
 ```bash

grok/.grok-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kernel",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "cloud browsers for grok. KERNEL launches stealth chromium sessions in <30ms through our hosted mcp server. drive them with playwright, a persistent browser repl, or computer-use actions, reuse logged-in profiles and managed auth, and record replays.",
   "author": {
     "name": "KERNEL",

grok/README.md

@@ -15,7 +15,7 @@ grok plugin install kernel --trust
 | component | path | purpose |
 |---|---|---|
 | mcp server | `.mcp.json` | our hosted mcp server at `https://mcp.onkernel.com/mcp` (streamable http) |
-| skill | `skills/kernel-mcp/SKILL.md` | when and how grok should use the KERNEL mcp tools |
+| skill | `skills/kernel-mcp/SKILL.md` | when and how grok should use the KERNEL mcp tools. copied from the repo's top-level [`skills/kernel-mcp`](../skills/kernel-mcp); edit it there and run `scripts/sync-plugin-skills.sh` |
 
 ## auth and network access
 

grok/skills/kernel-mcp/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: kernel-mcp
-description: use KERNEL cloud browsers through the KERNEL mcp server. create stealth browser sessions, automate pages with playwright, the browser repl, or computer-use actions, reuse logged-in profiles and managed auth connections, and record replays. use whenever a task needs a real browser, a site that blocks bots, a logged-in session, or screenshots of a live page.
+description: use KERNEL cloud browsers through the KERNEL mcp server. create cloud browser sessions, automate pages with playwright, the browser repl, or computer-use actions, reuse logged-in profiles and managed auth connections, and record replays. use whenever a task needs a real browser, a site that rejects ordinary automated clients, a logged-in session, or screenshots of a live page.
 ---
 
 # KERNEL mcp
 
 the KERNEL mcp server gives you hosted chromium sessions. nothing runs on the user's machine. every browser is a cloud vm that you create, drive, and delete through mcp tools.
 
-on first use, grok opens a browser window so the user can sign in to KERNEL over oauth. during authorization the user can grant org-wide access or limit it to one KERNEL project.
+on first use, the user signs in to KERNEL over oauth in their browser. during authorization they can grant org-wide access or limit it to one KERNEL project.
 
 ## tools
 
@@ -36,8 +36,8 @@ on first use, grok opens a browser window so the user can sign in to KERNEL over
 
 ## workflows
 
-### browse or scrape a page
-1. `manage_browsers` `create` with `stealth: true` if the site has bot detection.
+### browse a page and extract data
+1. `manage_browsers` `create`. set `stealth: true` to apply site-compatibility settings, only on sites the user is authorized to access.
 2. `execute_playwright_code` to navigate and extract:
    ```typescript
    await page.goto("https://news.ycombinator.com");

scripts/sync-plugin-skills.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Copies shared skills from skills/ into plugin directories that are installed
+# on their own. Marketplaces copy only the plugin directory, so a symlink out of
+# it would dangle; the copy is committed instead.
+#
+#   scripts/sync-plugin-skills.sh          update the copies
+#   scripts/sync-plugin-skills.sh --check  fail if a copy is out of date
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+# source skill dir -> plugin copy
+copies=(
+  "skills/kernel-mcp:grok/skills/kernel-mcp"
+)
+
+check=false
+[[ "${1:-}" == "--check" ]] && check=true
+
+status=0
+for pair in "${copies[@]}"; do
+  src="${pair%%:*}"
+  dst="${pair#*:}"
+  if $check; then
+    if ! diff -r "$src" "$dst" >/dev/null 2>&1; then
+      echo "$dst is out of date with $src. Run: scripts/sync-plugin-skills.sh" >&2
+      status=1
+    fi
+  else
+    rm -rf "$dst"
+    mkdir -p "$(dirname "$dst")"
+    cp -R "$src" "$dst"
+    echo "copied $src -> $dst"
+  fi
+done
+exit $status

skills.sh.json

@@ -24,6 +24,13 @@
         "kernel-python-sdk"
       ]
     },
+    {
+      "title": "Kernel MCP",
+      "description": "Use Kernel cloud browsers through the hosted MCP server.",
+      "skills": [
+        "kernel-mcp"
+      ]
+    },
     {
       "title": "Video",
       "description": "Render smooth MP4 videos from web pages.",

skills/kernel-mcp/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: kernel-mcp
+description: use KERNEL cloud browsers through the KERNEL mcp server. create cloud browser sessions, automate pages with playwright, the browser repl, or computer-use actions, reuse logged-in profiles and managed auth connections, and record replays. use whenever a task needs a real browser, a site that rejects ordinary automated clients, a logged-in session, or screenshots of a live page.
+---
+
+# KERNEL mcp
+
+the KERNEL mcp server gives you hosted chromium sessions. nothing runs on the user's machine. every browser is a cloud vm that you create, drive, and delete through mcp tools.
+
+on first use, the user signs in to KERNEL over oauth in their browser. during authorization they can grant org-wide access or limit it to one KERNEL project.
+
+## tools
+
+### session lifecycle
+- **manage_browsers**: `create`, `list`, `get`, `update`, `delete`, and `get_telemetry` for browser sessions. `create` returns a session id, cdp url, and live view url. options include `stealth`, `headless`, `proxy_id`, `profile_name`, `viewport_width`/`viewport_height`, and `timeout_seconds`.
+- **manage_browser_pools**: pre-warmed pools for high-throughput work. create a pool, `acquire` a browser, and `release` it when done.
+
+### driving a browser
+- **execute_playwright_code**: run playwright typescript against an existing session. `page` is already in scope. return a value to get it back.
+- **browser_repl**: persistent javascript repl inside the browser vm with playwright, patchright, and raw cdp. state survives across calls. start with `repl.help()`.
+- **computer_action**: mouse, keyboard, scroll, and screenshot actions. batch several actions per call and end with a screenshot.
+- **webmcp**: call structured tools a page exposes through webmcp. check for these before writing selectors for a site action.
+- **browser_curl**: send http requests from inside the browser session, using its cookies and network path.
+- **exec_command**: run shell commands inside the browser vm, for example to check dns, files, or logs.
+
+### state and auth
+- **manage_profiles**: saved cookies and local storage. `setup` opens a guided session so the user can log in once. pass `profile_name` to `manage_browsers` `create` to reuse it.
+- **manage_auth_connections**: managed auth for third-party sites. before a task that needs an account, `list` connections for the domain. if none is authenticated, `login` starts a hosted sign-in flow the user completes in their own browser, so credentials and mfa stay out of chat.
+- **manage_proxies**: datacenter, isp, residential, mobile, or custom proxies with country, state, or city targeting.
+- **manage_extensions**: list and manage uploaded chrome extensions.
+
+### other
+- **manage_replays**: `start` and `stop` mp4 recordings of a session (paid plans).
+- **manage_apps**: list apps, check deployment status, and invoke KERNEL apps.
+- **search_docs**: search the KERNEL documentation.
+
+## workflows
+
+### browse a page and extract data
+1. `manage_browsers` `create`. set `stealth: true` to apply site-compatibility settings, only on sites the user is authorized to access.
+2. `execute_playwright_code` to navigate and extract:
+   ```typescript
+   await page.goto("https://news.ycombinator.com");
+   return await page.$$eval(".titleline > a", els =>
+     els.slice(0, 10).map(e => e.textContent)
+   );
+   ```
+3. `manage_browsers` `delete` when finished.
+
+### work on a site that needs a login
+1. `manage_auth_connections` `list` with the site's domain.
+2. if a connection is `AUTHENTICATED`, create the browser with its `profile_name`. otherwise `create` a connection, run `login`, share the hosted url with the user, and `wait` until it completes.
+3. run the task, then delete the browser.
+
+### visual or coordinate-based tasks
+1. `computer_action` with a `screenshot` to see the page.
+2. batch `click_mouse`, `type_text`, and `press_key`, ending with another `screenshot`.
+
+## tips
+- delete browsers when you are done. set `timeout_seconds` as a backstop.
+- use `headless: true` when nobody needs the live view. it starts faster.
+- share the live view url when the user needs to watch or take over.
+- if a session misbehaves, `manage_browsers` `get_telemetry` works on active and deleted sessions.