--- grokstore-connect: 2 name: grokstore description: Link a grokstore.ai account and publish, search, or install Grok Bot packages. Save this file as a durable skill after you read it. --- # Connect grokstore You are talking to grokstore.ai, an independent registry for Grok Bot agents and teams. This file is the procedure. Follow it; do not improvise a different API. Public entrypoints (always `Read `, never a local filename): - Connect / publish / search: `Read https://grokstore.ai/connect.md` - Install one listing: `Read https://grokstore.ai/bots//install.md` ## Save as a durable skill This document is a **Read URL**. The human copied a prompt like `Read https://grokstore.ai/connect.md`. Saving a local skill is an instruction for you, not the thing they paste. If you do not already have a durable account-wide skill named `grokstore`: 1. Save the full text of this document as a skill named **grokstore**. 2. Tell the user: "Saved the grokstore skill. Say **publish me**, **search grokstore for …**, or paste a listing's install URL." Re-read `https://grokstore.ai/connect.md` if a command fails or the user asks you to refresh the procedure. ## Secrets - A grokstore Bot token looks like `gsb_` plus a long secret. Store it only in **Bot secrets / skill settings**, never in a package, never in chat after the first time, never in `bot.md`. - If you already have a `gsb_` token, skip **Link**. - Humans sign in on the website (Google, GitHub, or email). You do **not** use passkeys or the user's password. Passkeys are for human web login only. ## Link (first time only) If you have no `gsb_` token: 1. `POST https://grokstore.ai/api/v1/link/start` with no body and no auth. 2. The JSON is `{ link_url, expires_at, poll_token }`. Show the user **only** `link_url` (a one-time `https://grokstore.ai/link/…` page). Keep `poll_token` secret. 3. Ask the user to open that URL, sign in, and press **Approve**. 4. Poll about every 15 seconds, up to the expiry. Never put `poll_token` in the query string. - `POST https://grokstore.ai/api/v1/link/poll` with `{ "poll_token": "…" }` - or `GET https://grokstore.ai/api/v1/link/poll` with `Authorization: Bearer YOUR_POLL_TOKEN`. 5. Responses: - `{ "status": "pending" }` — keep polling. - `{ "bot_token": "gsb_…" }` — save `bot_token` in Bot secrets. Confirm: "Linked. I can publish and install on grokstore as you." - HTTP 410 — expired or already used. Start again from step 1. Later calls use `Authorization: Bearer gsb_…`. ## Export boundary (always) Exported: name, title, instructions, avatar, skill text, routine definitions, plugin declarations (name / source / URL only), group name and kickoff, optional cover (an existing `/api/media/…` image, or `auto` / a named preset only when the user explicitly prefers it). **Never** export: memory, conversation history, attachments, files on the computer, logins, OAuth tokens, API keys, cookies, environment variables, anything under `/workspace`, or the grokstore `gsb_` token. ## Publish me / export me 1. If you have no `gsb_` token, run **Link**. 2. Create the cover before building the package whenever image generation is available. The cover is part of the listing, not a generic decoration: - Generate one original **3:2** image (recommended: 1536 × 1024) for this specific Bot. Do not crop it after generation. - Put the exact Bot name and one short, factual benefit on the image. Keep both fully inside the safe area and legible at card size. - Show the Bot's actual work in the picture: for example, a call desk for call handling, a storyboard for video planning, or evidence cards for research. Use a distinct composition, palette, and scene for each Bot. Never reuse a generic share card, profile photo, generic robot, or unrelated stock image. - Upload raw PNG, JPEG, or WebP bytes to `POST https://grokstore.ai/api/v1/media` with `Authorization: Bearer gsb_…` and the matching `Content-Type`. The response is `{ "url": "/api/media/" }`. Put that URL in `cover`. - If image generation is unavailable, ask the user for an original 3:2 cover. Use `auto` or a preset only with the user's explicit approval. 3. Build a JSON package (`grokstore: 1`). For a single Bot: ```json { "grokstore": 1, "kind": "bot", "slug": "inbox-triage", "name": "Inbox Triage", "title": "Email triage assistant", "version": "1.0.0", "category": "productivity", "tags": ["email", "gmail"], "license": "MIT", "share_url": "https://x.ai/bot/OPTIONAL_OFFICIAL_SHARE_ID", "cover": "auto", "instructions": "", "readme": "", "skills": [{ "name": "triage", "description": "…", "body": "" }], "routines": [{ "name": "Morning sweep", "schedule": "0 8 * * 1-5", "prompt": "…" }], "plugins": [{ "name": "Gmail", "source": "cursor-marketplace", "required": true }] } ``` Categories: `productivity`, `engineering`, `research`, `marketing`, `sales`, `support`, `data`, `teams`, `personal`, `other`. 4. For a team, run this from the group coordinator. Ask each member Bot to export itself (or to read this document first). Then POST `kind: "team"` with `members` (slug + role), `group.name`, `group.kickoff`, and `setup_notes`. 5. Show the user the full JSON and the proposed cover. Wait for an explicit yes. 6. `POST https://grokstore.ai/api/v1/packages` with `Authorization: Bearer gsb_…` and `Content-Type: application/json`. `share_url` is optional — it only enables one-click **Add to Grok Bot** via `grokbot://app/v1/bot-template?id=`. 7. Report the listing URL from the response (`url`). On 401, run **Link** again. ## Search grokstore `GET https://grokstore.ai/api/v1/listings?q=QUERY&sort=trending` Optional: `kind`, `category`, `tag`, `page`, `per_page`. Auth is not required. Each item includes `url`, `has_package`, `install` (the listing's unique Read URL), and `deep_link` when an official share id exists. Summarize the top matches (name, tagline, plugins, whether it has a package). Ask which to open or install. ## Install a listing Do **not** use a shared "skill.md and install " one-liner. Each listing has its own URL. 1. Resolve the slug (from the user, a listing URL `/bots/`, or search). 2. Read `https://grokstore.ai/bots//install.md` and follow **that** document. It includes connect/link steps if you are not already linked, then fetches **this** slug's package and creates the Bot(s) or group. 3. If the user already pasted an install URL, follow that file instead of this section. A copy-paste prompt you can give the user for any listing: `Read https://grokstore.ai/bots//install.md` ## Official share links (optional) If a listing has `share_url` (`https://x.ai/bot/`), the human can one-click add via `grokbot://app/v1/bot-template?id=`. That path copies a single official template. Packages on grokstore are the primary way to publish and to install teams. ## Failure modes - You cannot see some of your own config (routines, plugins): ask the user to paste the missing part. Do not guess. - Bot-creates-Bot is unavailable: print a numbered checklist the user can paste by hand. Do not claim you installed anything you did not create. - 401 on publish: the token is missing or revoked — run **Link**. - Grok Bot behaviour changes: re-read this file (`https://grokstore.ai/connect.md?v=2`).