firecrawl / firecrawl/cli

firecrawl init installs skills to every known agent by default, even ones not installed on the machine

Open
#149 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
631
Forks
100
Avg merge
5h 9m
Merged PRs (30d)
25

Description

## Description

Running `firecrawl init` (with no `--all` or `--agent` flag) silently installs
skills to *every* agent known by the `skills` package (vercel-labs/skills),
not just the agents actually present on the machine. This creates dozens of
unexpected hidden directories in `$HOME` (e.g. `.openclaw`, `.junie`, `.kiro`,
`.trae`, `.vibe`, `.zencoder`, `.moxby`, `.pochi`, ...) for coding agents the
user never installed.

## Root cause

In `src/commands/skills-install.ts`:

```ts
const installToAllAgents = options.agent ? false : (options.all ?? true);
if (installToAllAgents) {
args.push('--all');
}
```

`options.all` defaults to `undefined`, so `installToAllAgents` evaluates to
`true` unless the caller explicitly passes `--agent`. This means
`buildSkillsInstallArgs()` appends `--all` to the underlying `npx skills add`
call by default, which is a shorthand for `--agent '*'` in the `skills`
CLI — i.e. install to *all* agents, detected or not.

`src/commands/init.ts` (`installSkillRepoQuiet`) calls
`buildSkillsInstallArgs({ repo, agent: options.agent, ... })` without ever
setting `all: false`, so a plain `npx firecrawl-cli init -y --browser` (no
`--all` passed by the user at all) ends up running:

```
npx -y skills add firecrawl/cli --full-depth --global --all
```

## The detection logic already exists — but is unreachable

`src/commands/skills-native.ts` has a `detectInstalledAgents()` function
(line 266) that checks `$HOME` for each agent's config directory and only
installs skills where the agent is actually present. This is exactly the
behavior users would expect by default.

However, this function is *only* invoked from `installSkillsNative()`
(line 404), which itself is only called as a fallback when `hasNpx()` returns
`false` (`init.ts:134`, `setup.ts:323`) — i.e. only on machines without
Node.js/npx. On any normal machine (npx present, the common case), the code
always takes the `execSync('npx skills add ... --all')` path and the
detection logic is never consulted.

There is also no user-facing CLI flag to opt into the detection-based
install path. The only related flag is `nativeSkills`
(`SetupOptions.nativeSkills` in `setup.ts:43`), but it is not wired to any
`--native`/`--native-skills` CLI option — it's only ever hardcoded to `true`
internally in `src/commands/launch.ts:284`, for a narrow flow that installs
skills for one specific already-known `target.skillsAgent` during
`firecrawl launch`. It is unreachable from `firecrawl init` or
`firecrawl setup skills`.

The only user-facing way to avoid the `--all` spray today is `-a, --agent
` (`index.ts:2144`), which requires the user to already know and type
the exact agent slug — there is no discovery or auto-detection available to
a normal `init` run.

## Steps to reproduce

1. On a machine with only Claude Code installed (no Cursor, Windsurf, Trae,
Kiro, Junie, etc.)
2. Run `npx -y firecrawl-cli@latest init -y --browser`
3. Inspect `$HOME` afterwards

## Expected behavior

`firecrawl init` should only install skills into agents actually detected on
the machine (reusing the existing `detectInstalledAgents()` logic), unless
the user explicitly opts in to `--all`.

## Actual behavior

Dozens of new hidden directories (`~/.openclaw`, `~/.kiro`, `~/.trae`,
`~/.vibe`, `~/.zencoder`, `~/.junie`, ...) are created in `$HOME` for agents
that were never installed, without any warning or confirmation prompt, and
there is no default-path way to avoid it short of manually specifying
`--agent `.

## Suggested fix

- Default `installToAllAgents` to `false` in
`buildSkillsInstallArgs`/`installSkillRepoQuiet`, requiring an explicit
`--all` from the user to spray into every known agent.
- Reuse `detectInstalledAgents()` (or an equivalent check against the
`skills` package's own detection) on the `npx` code path too, not just the
native fallback, so detection-based install is the default regardless of
whether npx is available.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in src/commands/skills-install.ts and trace buildSkillsInstallArgs() from src/commands/init.ts through the npx path, then compare it with detectInstalledAgents() and installSkillsNative() in src/commands/skills-native.ts. Check the related option handling in src/commands/init.ts, setup.ts, and index.ts. Done means plain init installs only for detected agents, while explicit --all still targets every known agent.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.