diff --git a/cmd/prime_context.md b/cmd/prime_context.md
index a229819..8517563 100644
--- a/cmd/prime_context.md
+++ b/cmd/prime_context.md
@@ -16,7 +16,9 @@ Auth uses service account tokens exchanged for JWTs. Check status with:
 cio auth status
 ```
 
-If auth fails, ask the user to run `cio auth login` and paste their `sa_live_` token.
+If auth fails or there is no token yet, read `cio skills read cli/auth.md`
+and follow its login flow. Never have the user paste a token into the
+conversation or pass one as a shell argument.
 
 ## Profiles
 
@@ -74,6 +76,7 @@ Skills provide behavioral guidance, multi-step workflows, and gotchas that are N
 cio skills                              # list available skills
 cio skills read fly-api                 # Customer.io API guidance — routes to sub-files
 cio skills read fly-api/campaigns.md    # campaign workflows, edge wiring, gotchas
+cio skills read cli                     # skills unique to the CLI (onboarding, auth/login, integration, go-live)
 cio skills read design-studio           # Design Studio email creation workflow
 cio skills read design-studio/nodes.md  # node creation, component markup
 ```
diff --git a/skills/cio/SKILL.md b/skills/cio/SKILL.md
index 6f07888..166caa2 100644
--- a/skills/cio/SKILL.md
+++ b/skills/cio/SKILL.md
@@ -30,8 +30,7 @@ Use runtime references instead of copying large playbooks into this skill:
 
 - `cio schema` for commands, flags, generic API routes, and payload shapes.
 - `cio skills` to list currently available Customer.io reference skills.
-- `cio skills read cio` for builder onboarding, sandbox, first integration,
-  transactional proof, billing activation checks, and go-live playbooks.
+- `cio skills read cli` for skills unique to the CLI (auth/login, integration, onboarding/new user setup); read it for the full index.
 - `cio skills read <skill>` for the specific service-hosted reference needed.
 - `cio api <path>` for API coverage that is not wrapped by a bespoke command.
 
@@ -39,7 +38,7 @@ Common routing:
 
 - Builder/startup setup, signup, sandbox, first app integration,
   transactional proof, billing activation checks, and go-live start with
-  `cio prime` and `cio skills read cio`.
+  `cio prime` and `cio skills read cli`.
 - Existing Journeys resources such as campaigns, segments, templates,
   customers, newsletters, and subscription topics should use
   `cio skills read fly-api`.