Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/sunflowermm/XRK-AGT --skill xrk-authThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
编写或审查 core/*/www 静态页、校园 WebView 兼容、HttpResponse 前端解包时使用。Core www 走浏览器兼容层（xrk-www-compat）。含零配置静态与有 sign.json（纯静态/产物/反代，sign↔server 合并）挂载。
编写或审查 core/src 代码时，确保使用 Node 26 稳定 API，禁止旧写法（fetch/exec/错误/二进制）。AI 改 Core 前必读。
当你需要开发/排查 HTTP 抓取、SSRF、Playwright 受控浏览器、本地字体增强截图，或判断 web_fetch 与 browser 工作流如何选型时使用。
Based on SOC occupation classification
Showing SKILL.md
| name | xrk-auth |
| description | 当你需要解释/排查 HTTP 或 WebSocket 的 401、127 回环例外、API Key 机制时使用；确保业务层不重复鉴权。 |
docs/AUTH.mdsrc/agent-runtime.js（_authMiddleware、checkApiAuthorization、wsConnect）src/infrastructure/http/runtime-auth.js、runtime-ws.js、auth.js/api/ 由 HttpApi + AgentRuntime.checkApiAuthorization；公开路由 systemAuth: false。server.auth.loopbackExempt===true 时才允许「本机 Host+127」免 Key（公网/反代勿开）。runEnabled=true 时即便 exempt 也强制 Key。wsConnect → runtime-ws；AgentRuntime.wsf[path] 可为 { handler, skipAuth: true } 跳过系统 Key。Header：X-API-Key、Api-Key、Authorization: Bearer|Token|ApiKey <key>；查询仅 api_key / apiKey。不接受 body 与 token/key 等易撞字段。
Error.isError，勿 instanceof Error（skill xrk-node-runtime）。AbortSignal.timeout。