firecrawl init installs skills to every known agent by default, even ones not installed on the machine

Inizia in src/commands/skills-install.ts e segui buildSkillsInstallArgs() da src/commands/init.ts attraverso il percorso npx, quindi confrontalo con detectInstalledAgents() e installSkillsNative() in src/commands/skills-native.ts. Controlla la gestione delle opzioni correlata in src/commands/init.ts, setup.ts e index.ts. Il lavoro è completo quando un init semplice installa solo per gli agent rilevati, mentre --all esplicito continua a essere indirizzato a ogni agent noto.

Description

Running firecrawl init (with no --all or --agent flag) silently installs
skills to every agent known by the skills package (vercel-labs/skills),
not just the agents actually present on the machine. This creates dozens of
unexpected hidden directories in $HOME (e.g. .openclaw, .junie, .kiro,
.trae, .vibe, .zencoder, .moxby, .pochi, ...) for coding agents the
user never installed.

Root cause

In src/commands/skills-install.ts:

const installToAllAgents = options.agent ? false : (options.all ?? true);
if (installToAllAgents) {
  args.push('--all');
}

options.all defaults to undefined, so installToAllAgents evaluates to
true unless the caller explicitly passes --agent. This means
buildSkillsInstallArgs() appends --all to the underlying npx skills add
call by default, which is a shorthand for --agent '*' in the skills
CLI — i.e. install to all agents, detected or not.

src/commands/init.ts (installSkillRepoQuiet) calls
buildSkillsInstallArgs({ repo, agent: options.agent, ... }) without ever
setting all: false, so a plain npx firecrawl-cli init -y --browser (no
--all passed by the user at all) ends up running:

npx -y skills add firecrawl/cli --full-depth --global --all

The detection logic already exists — but is unreachable

src/commands/skills-native.ts has a detectInstalledAgents() function
(line 266) that checks $HOME for each agent's config directory and only
installs skills where the agent is actually present. This is exactly the
behavior users would expect by default.

However, this function is only invoked from installSkillsNative()
(line 404), which itself is only called as a fallback when hasNpx() returns
false (init.ts:134, setup.ts:323) — i.e. only on machines without
Node.js/npx. On any normal machine (npx present, the common case), the code
always takes the execSync('npx skills add ... --all') path and the
detection logic is never consulted.

There is also no user-facing CLI flag to opt into the detection-based
install path. The only related flag is nativeSkills
(SetupOptions.nativeSkills in setup.ts:43), but it is not wired to any
--native/--native-skills CLI option — it's only ever hardcoded to true
internally in src/commands/launch.ts:284, for a narrow flow that installs
skills for one specific already-known target.skillsAgent during
firecrawl launch. It is unreachable from firecrawl init or
firecrawl setup skills.

The only user-facing way to avoid the --all spray today is -a, --agent <agent> (index.ts:2144), which requires the user to already know and type
the exact agent slug — there is no discovery or auto-detection available to
a normal init run.

Steps to reproduce

1. On a machine with only Claude Code installed (no Cursor, Windsurf, Trae,
   Kiro, Junie, etc.)
2. Run npx -y firecrawl-cli@latest init -y --browser
3. Inspect $HOME afterwards

Expected behavior

firecrawl init should only install skills into agents actually detected on
the machine (reusing the existing detectInstalledAgents() logic), unless
the user explicitly opts in to --all.

Actual behavior

Dozens of new hidden directories (~/.openclaw, ~/.kiro, ~/.trae,
~/.vibe, ~/.zencoder, ~/.junie, ...) are created in $HOME for agents
that were never installed, without any warning or confirmation prompt, and
there is no default-path way to avoid it short of manually specifying
--agent <name>.

Suggested fix

• Default installToAllAgents to false in
  buildSkillsInstallArgs/installSkillRepoQuiet, requiring an explicit
  --all from the user to spray into every known agent.
• Reuse detectInstalledAgents() (or an equivalent check against the
  skills package's own detection) on the npx code path too, not just the
  native fallback, so detection-based install is the default regardless of
  whether npx is available.