Turn repeatable work into a skill
A skill is a folder of Markdown instructions, scripts, and resources. Place repository-owned skills under .grok/skills and personal skills under ~/.grok/skills; enabled plugins can contribute skills as well.
Keep a skill narrow and executable: state when it applies, required inputs, safe tool boundaries, verification, and failure behavior. User-invocable skills appear as slash commands, while the extensions modal shows what Grok discovered.
- Version project skills with the repository.
- Keep credentials out of skill files and resources.
- Test a skill on success, failure, and ambiguous inputs.
/skillsInstall plugins as executable dependencies
Plugins can bundle skills, agents, hooks, MCP servers, and LSP servers. Inspect the source, requested capabilities, pinned revision, and maintenance ownership before trusting a remote package.
Use the marketplace list to understand configured sources, then install an explicit plugin name. The official marketplace verifies pinned commit SHAs, but that integrity check does not replace code review or least privilege.
/marketplace
grok plugin marketplace list
grok plugin install <name> --trust
grok plugin details <name>Use hooks as observable guardrails
Hooks run scripts around tool and session lifecycle events. Put project hooks under .grok/hooks only when the team owns their behavior; project hooks require an explicit /hooks-trust decision.
A PreToolUse hook can inspect a request and explicitly deny it, but a timeout, crash, or malformed response fails open. Never make a hook the sole boundary for a consequential action: enforce permission deny rules and sandbox limits as well. Keep hooks deterministic, time-bounded, observable, and aligned with the documented JSON contract.
- Only an explicit deny blocks; hook failure does not.
- Trust a project only after reading its hook scripts.
- Keep a rollback path for every extension update.
/hooks
/hooks-trust
/plugins