[UX] postinstall silently injects 25 arkcli skills into every detected AI agent — should be opt-in

[thomasheep]

Summary

npm i -g @volcengine/ark-cli (v1.0.23) triggers +connect --refresh from its postinstall script, which silently installs 25 arkcli-* skills into every detected AI agent on the machine (pi, codex, cursor, trae, opencode, openclaw, claude(-code), gemini-cli, ...) — with no explicit consent, and with a notice that is invisible in non-interactive / piped / no-tty contexts.

Evidence (2026-08-29)

• scripts/postinstall.js ends with execFileSync(binPath, ["+connect","--refresh"]). The only "notice" is writeInstallNotice() which writes to /dev/tty (or console.warn) — invisible when npm runs without a controlling tty.
• After a plain npm i -g @volcengine/ark-cli, on this machine, at one timestamp:
  • ~/.agents/skills/ (Pi): 25 arkcli-* dirs + .arkcli-managed-skills.json
  • ~/.config/opencode/skills/ (opencode): the same 25 + its own manifest
• The installed binary detects ≥14 agent types: pi, codex, cursor, trae, opencode, openclaw, claude, claude-code, gemini-cli, qoder, pochi, junie, iflow, firebender, cortex.
• The shipped arkcli-connect skill doc states that +connect default behavior is "install to all detected agents", and that "official catalog names take highest priority and will overwrite even user-modified same-name skills".

Relation to #9

#9 asked to stop copying skills into ~/.pi/agent/skills/; maintainers confirmed it and moved installs to the shared ~/.agents/skills. That fixed the location, but the root UX problem remains: postinstall still silently injects skills into every agent, and it can overwrite user-modified same-name skill dirs.

Requested change (opt-in)

1. postinstall must not inject skills — only ship them inside the package. Do not run +connect from install.
2. Make the first human arkcli +connect run an explicit, interactive consent step (or a documented opt-in, e.g. ARKCLI_CONNECT=1).
3. Document the side effect prominently in the README / npm metadata.
4. Never overwrite user-modified same-name skills; keep authoritative-catalog overwrite only behind an explicit --force.

Agent skills are auto-loaded by the model and shape its behavior — silently injecting them into every AI toolchain is a trust/boundary issue even when the content is benign. Making installation optional resolves it cleanly.