kiro-social-onboarder

Automates Kiro CLI social Google or GitHub login and llm-access account import.

2|Updated Jun 18, 2026
One-click install
npx skills add https://github.com/zero-yx/static_flow --skill kiro-social-onboarder-zero-yx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kiro-social-onboarder
Source: https://github.com/zero-yx/static_flow/tree/main/skills/kiro-social-onboarder
Command: npx skills add https://github.com/zero-yx/static_flow --skill kiro-social-onboarder-zero-yx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Onboarding a Kiro social account into the StaticFlow llm-access gateway requires a fragile multi-step flow: proxied OAuth device authorization, browser-based Google or GitHub login with 2FA, local SQLite auth cleanup, account import, proxy assignment, and student-tier balance verification. This Skill automates that entire pipeline without running kiro-cli logout. ## Core Features & Use Cases - End-to-end social login automation: Drives an isolated Chrome profile via DevTools to complete Google or GitHub login, device approval, and token polling through a required HTTP proxy. - Safe local auth reset: Backs up the Kiro SQLite database and deletes only known auth metadata keys instead of logging out, preserving other local state. - llm-access import and repair: Imports new accounts under explicit names or refreshes existing auth_401 GitHub accounts by matching upstream user_id via a temporary probe account. - Student-tier verification: Refreshes the account balance and fails unless the account is KIRO STUDENT with at least 1000 usage limit. - Use Case: A Kiro GitHub-backed account in llm-access starts returning 401 errors. Run the GitHub onboarding script without --account-name; it re-authenticates through the proxy, matches the existing account by user_id, writes the new token pair, and confirms the student balance. ## Quick Start Ask the agent to onboard a Google social Kiro account by running the bundled script with your email, an account name, and the password supplied through the KIRO_GOOGLE_PASSWORD environment variable.

Frequently Asked Questions about kiro-social-onboarder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I onboard a Kiro social Google account into llm-access?▼

Run the onboard_kiro_social_google.py script with --email, --account-name, and the password in the KIRO_GOOGLE_PASSWORD environment variable. The script handles proxied device authorization, browser login, local token write, importer dry-run and apply, and balance verification in one flow.

How do I refresh a Kiro GitHub account with auth_401 errors?▼

Run onboard_kiro_social_github.py without --account-name. It re-authenticates through the proxy, probes the refreshed credentials with a temporary account, matches the existing llm-access account by upstream user_id, and writes the new token pair back to it.

Does the Kiro onboarding flow require kiro-cli logout?▼

No, the flow never runs kiro-cli logout. It backs up the local data.sqlite3 file and deletes only known Kiro auth metadata keys such as kirocli:social:token and OIDC registration entries before writing the new social token.

Can I pass Google or GitHub passwords as command-line arguments?▼

No, passwords must come from environment variables (KIRO_GOOGLE_PASSWORD or KIRO_GITHUB_PASSWORD) or an interactive hidden prompt. 2FA codes are never scripted; you complete 2FA and unusual verification manually in the launched browser.

What happens if the Kiro account is not KIRO STUDENT tier?▼

The script refreshes the balance and fails by default unless the subscription title contains STUDENT and the usage limit is at least 1000. You can relax this with --no-expect-student or --expect-usage-limit, but the failure is never hidden.

Why does the GitHub device flow fail with loginProvider errors?▼

The Kiro device authorization API expects the exact value loginProvider "Github", not the display spelling "GitHub". Sending the wrong casing causes the API to reject the device authorization request.