Keep · infra SKILL.md
One shared computer, /workspace handoffs, screens ≠ security
WhenUse when two Bots must share files, cookies, or a login.
StopNever put a credential on the computer if another Bot should not use it. Never paste passwords or OTPs into chat. Extra Bots are not a security boundary.
Steps
- Treat a login or file on the computer as available to the whole roster. Do not put a credential there if another Bot should not use it.
- Durable project files go in /workspace/<project>/ with clear names. Temp dirs, manually installed packages, and uncommitted app state are replaceable.
- Prefer a connector: Settings → Plugins → Add → auth in browser. Type @ to attach the connector, / for a skill. Connectors are account-wide.
- Use the browser only when there is no connector, or for a visual workflow the connector does not expose. One Bot = one computer-use task per screen; several Bots can run in parallel on separate screens.
- Sensitive step (password, passkey, 2FA, CAPTCHA, payment): open Agent Computer, take control, complete only the blocked step, return control. Never paste passwords or OTPs into chat. Use the masked secret request when the connection supports it.
- Sign in once. The session is then available to every other Bot. Ask the Bot to pause and notify you rather than bypassing a verification wall.
Load/workspace/<project>/. Connectors over browser. Takeover for 2FA/pay.
SourcexAI Grok Bot docs
--- name: One shared computer, /workspace handoffs, screens ≠ security description: Use when two Bots must share files, cookies, or a login. --- # One shared computer, /workspace handoffs, screens ≠ security When: Use when two Bots must share files, cookies, or a login. Stop: Never put a credential on the computer if another Bot should not use it. Never paste passwords or OTPs into chat. Extra Bots are not a security boundary. 1. Treat a login or file on the computer as available to the whole roster. Do not put a credential there if another Bot should not use it. 2. Durable project files go in /workspace/<project>/ with clear names. Temp dirs, manually installed packages, and uncommitted app state are replaceable. 3. Prefer a connector: Settings → Plugins → Add → auth in browser. Type @ to attach the connector, / for a skill. Connectors are account-wide. 4. Use the browser only when there is no connector, or for a visual workflow the connector does not expose. One Bot = one computer-use task per screen; several Bots can run in parallel on separate screens. 5. Sensitive step (password, passkey, 2FA, CAPTCHA, payment): open Agent Computer, take control, complete only the blocked step, return control. Never paste passwords or OTPs into chat. Use the masked secret request when the connection supports it. 6. Sign in once. The session is then available to every other Bot. Ask the Bot to pause and notify you rather than bypassing a verification wall. Load: /workspace/<project>/. Connectors over browser. Takeover for 2FA/pay.