firecrawl init installs skills to every known agent by default, even ones not installed on the machine
- Dominant language
- TypeScript
- Stars
- 631
- Forks
- 100
- Avg merge
- 5h 9m
- Merged PRs (30d)
- 25
Description
## Description
Running `firecrawl init` (with no `--all` or `--agent` flag) silently installs
skills to *every* agent known by the `skills` package (vercel-labs/skills),
not just the agents actually present on the machine. This creates dozens of
unexpected hidden directories in `$HOME` (e.g. `.openclaw`, `.junie`, `.kiro`,
`.trae`, `.vibe`, `.zencoder`, `.moxby`, `.pochi`, ...) for coding agents the
user never installed.
## Root cause
In `src/commands/skills-install.ts`:
```ts
const installToAllAgents = options.agent ? false : (options.all ?? true);
if (installToAllAgents) {
args.push('--all');
}
```
`options.all` defaults to `undefined`, so `installToAllAgents` evaluates to
`true` unless the caller explicitly passes `--agent`. This means
`buildSkillsInstallArgs()` appends `--all` to the underlying `npx skills add`
call by default, which is a shorthand for `--agent '*'` in the `skills`
CLI — i.e. install to *all* agents, detected or not.
`src/commands/init.ts` (`installSkillRepoQuiet`) calls
`buildSkillsInstallArgs({ repo, agent: options.agent, ... })` without ever
setting `all: false`, so a plain `npx firecrawl-cli init -y --browser` (no
`--all` passed by the user at all) ends up running:
```
npx -y skills add firecrawl/cli --full-depth --global --all
```
## The detection logic already exists — but is unreachable
`src/commands/skills-native.ts` has a `detectInstalledAgents()` function
(line 266) that checks `$HOME` for each agent's config directory and only
installs skills where the agent is actually present. This is exactly the
behavior users would expect by default.
However, this function is *only* invoked from `installSkillsNative()`
(line 404), which itself is only called as a fallback when `hasNpx()` returns
`false` (`init.ts:134`, `setup.ts:323`) — i.e. only on machines without
Node.js/npx. On any normal machine (npx present, the common case), the code
always takes the `execSync('npx skills add ... --all')` path and the
detection logic is never consulted.
There is also no user-facing CLI flag to opt into the detection-based
install path. The only related flag is `nativeSkills`
(`SetupOptions.nativeSkills` in `setup.ts:43`), but it is not wired to any
`--native`/`--native-skills` CLI option — it's only ever hardcoded to `true`
internally in `src/commands/launch.ts:284`, for a narrow flow that installs
skills for one specific already-known `target.skillsAgent` during
`firecrawl launch`. It is unreachable from `firecrawl init` or
`firecrawl setup skills`.
The only user-facing way to avoid the `--all` spray today is `-a, --agent
` (`index.ts:2144`), which requires the user to already know and type
the exact agent slug — there is no discovery or auto-detection available to
a normal `init` run.
## Steps to reproduce
1. On a machine with only Claude Code installed (no Cursor, Windsurf, Trae,
Kiro, Junie, etc.)
2. Run `npx -y firecrawl-cli@latest init -y --browser`
3. Inspect `$HOME` afterwards
## Expected behavior
`firecrawl init` should only install skills into agents actually detected on
the machine (reusing the existing `detectInstalledAgents()` logic), unless
the user explicitly opts in to `--all`.
## Actual behavior
Dozens of new hidden directories (`~/.openclaw`, `~/.kiro`, `~/.trae`,
`~/.vibe`, `~/.zencoder`, `~/.junie`, ...) are created in `$HOME` for agents
that were never installed, without any warning or confirmation prompt, and
there is no default-path way to avoid it short of manually specifying
`--agent `.
## Suggested fix
- Default `installToAllAgents` to `false` in
`buildSkillsInstallArgs`/`installSkillRepoQuiet`, requiring an explicit
`--all` from the user to spray into every known agent.
- Reuse `detectInstalledAgents()` (or an equivalent check against the
`skills` package's own detection) on the `npx` code path too, not just the
native fallback, so detection-based install is the default regardless of
whether npx is available.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in src/commands/skills-install.ts and trace buildSkillsInstallArgs() from src/commands/init.ts through the npx path, then compare it with detectInstalledAgents() and installSkillsNative() in src/commands/skills-native.ts. Check the related option handling in src/commands/init.ts, setup.ts, and index.ts. Done means plain init installs only for detected agents, while explicit --all still targets every known agent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100