Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

firecrawl init installs skills to every known agent by default, even ones not installed on the machine

Open
  • Is something wrong?
#149 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
55/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
typescript
Domain
cli

Research direction

Start in src/commands/skills-install.ts and trace buildSkillsInstallArgs() from src/commands/init.ts through the npx path, then compare it with detectInstalledAgents() and installSkillsNative() in src/commands/skills-native.ts. Check the related option handling in src/commands/init.ts, setup.ts, and index.ts. Done means plain init installs only for detected agents, while explicit --all still targets every known agent.

Written by the indexing model from the issue text.

Description

Description

Running firecrawl init (with no --all or --agent flag) silently installs
skills to every agent known by the skills package (vercel-labs/skills),
not just the agents actually present on the machine. This creates dozens of
unexpected hidden directories in $HOME (e.g. .openclaw, .junie, .kiro,
.trae, .vibe, .zencoder, .moxby, .pochi, ...) for coding agents the
user never installed.

Root cause

In src/commands/skills-install.ts:

const installToAllAgents = options.agent ? false : (options.all ?? true);
if (installToAllAgents) {
  args.push('--all');
}

options.all defaults to undefined, so installToAllAgents evaluates to
true unless the caller explicitly passes --agent. This means
buildSkillsInstallArgs() appends --all to the underlying npx skills add
call by default, which is a shorthand for --agent '*' in the skills
CLI — i.e. install to all agents, detected or not.

src/commands/init.ts (installSkillRepoQuiet) calls
buildSkillsInstallArgs({ repo, agent: options.agent, ... }) without ever
setting all: false, so a plain npx firecrawl-cli init -y --browser (no
--all passed by the user at all) ends up running:

npx -y skills add firecrawl/cli --full-depth --global --all

The detection logic already exists — but is unreachable

src/commands/skills-native.ts has a detectInstalledAgents() function
(line 266) that checks $HOME for each agent's config directory and only
installs skills where the agent is actually present. This is exactly the
behavior users would expect by default.

However, this function is only invoked from installSkillsNative()
(line 404), which itself is only called as a fallback when hasNpx() returns
false (init.ts:134, setup.ts:323) — i.e. only on machines without
Node.js/npx. On any normal machine (npx present, the common case), the code
always takes the execSync('npx skills add ... --all') path and the
detection logic is never consulted.

There is also no user-facing CLI flag to opt into the detection-based
install path. The only related flag is nativeSkills
(SetupOptions.nativeSkills in setup.ts:43), but it is not wired to any
--native/--native-skills CLI option — it's only ever hardcoded to true
internally in src/commands/launch.ts:284, for a narrow flow that installs
skills for one specific already-known target.skillsAgent during
firecrawl launch. It is unreachable from firecrawl init or
firecrawl setup skills.

The only user-facing way to avoid the --all spray today is -a, --agent <agent> (index.ts:2144), which requires the user to already know and type
the exact agent slug — there is no discovery or auto-detection available to
a normal init run.

Steps to reproduce

  1. On a machine with only Claude Code installed (no Cursor, Windsurf, Trae,
    Kiro, Junie, etc.)
  2. Run npx -y firecrawl-cli@latest init -y --browser
  3. Inspect $HOME afterwards

Expected behavior

firecrawl init should only install skills into agents actually detected on
the machine (reusing the existing detectInstalledAgents() logic), unless
the user explicitly opts in to --all.

Actual behavior

Dozens of new hidden directories (~/.openclaw, ~/.kiro, ~/.trae,
~/.vibe, ~/.zencoder, ~/.junie, ...) are created in $HOME for agents
that were never installed, without any warning or confirmation prompt, and
there is no default-path way to avoid it short of manually specifying
--agent <name>.

Suggested fix

  • Default installToAllAgents to false in
    buildSkillsInstallArgs/installSkillRepoQuiet, requiring an explicit
    --all from the user to spray into every known agent.
  • Reuse detectInstalledAgents() (or an equivalent check against the
    skills package's own detection) on the npx code path too, not just the
    native fallback, so detection-based install is the default regardless of
    whether npx is available.
Dominant language
TypeScript
Stars
635
Forks
106
Avg merge
4h 16m
Merged PRs (30d)
48

Getting set up

We have not checked this project's setup files yet. Start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from firecrawl/cli

All issues in firecrawl/cli

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.