Running host-setup/linux/install-skills.sh under sudo operates as root rather than as the invoking user, and nothing in the script or the installer it drives detects or guards against that.
scripts/skills_install.py:54 resolves the target directory with Path.home() / ".agents". Under sudo, $HOME is root's home by default, so the skills land in /root/.agents/skills instead of the invoking user's ~/.agents/skills, silently, since the run still exits 0.
scripts/skills_install.py:157, claude_available(), checks shutil.which("claude") against $PATH. sudo replaces $PATH with its own secure_path by default, so a claude CLI installed on the invoking user's own PATH (an npm global, nvm, or similar user-local install) is invisible to the sudo'd process. The run reports "Claude Code marketplace registered: False" even on a host where claude is on PATH for the actual user, and a re-run as that user reports True for the identical tree.
host-setup/linux/install-skills.sh never checks EUID, $SUDO_USER, or otherwise guards against this, despite its own docstring and --help text both saying "Installs the fleet skills for the current user" (install-skills.sh:3, install-skills.sh:31-34). Nothing else in host-setup/ needs sudo for this step: install-tools.sh and upgrade-host.sh are the ones that touch system package state, and install-skills.sh writes only under the user's home.
What this looks like in practice
$ sudo host-setup/linux/install-skills.sh
`claude` not found on PATH, skipping Claude Code marketplace registration (Codex/opencode global skills were still installed).
Installed to /root/.agents/skills. Claude Code marketplace registered: False.
$ host-setup/linux/install-skills.sh
Installed to /home/<user>/.agents/skills. Claude Code marketplace registered: True.
Both runs exit 0, so nothing marks the first one as wrong. A user who runs the sudo-prefixed form out of habit, since the two sibling scripts in the same stand-up flow, install-tools.sh and upgrade-host.sh, both need sudo, gets an apparently successful install that the report step (install-skills.sh --report, run as themselves) still calls missing.
Shapes that would close it
Not a recommendation, just what seems available:
- Refuse under
sudo/root. install-skills.sh checks EUID (or $SUDO_USER) up front and dies with a message pointing at running it as the normal user instead, matching what its own docs already promise.
- Accept it and target the invoking user. Resolve the real target home from
$SUDO_USER (via getent passwd or similar) when running under sudo, and read claude_available() against that user's PATH rather than root's, so the sudo'd and non-sudo'd runs agree.
Running
host-setup/linux/install-skills.shundersudooperates as root rather than as the invoking user, and nothing in the script or the installer it drives detects or guards against that.scripts/skills_install.py:54resolves the target directory withPath.home() / ".agents". Undersudo,$HOMEis root's home by default, so the skills land in/root/.agents/skillsinstead of the invoking user's~/.agents/skills, silently, since the run still exits 0.scripts/skills_install.py:157,claude_available(), checksshutil.which("claude")against$PATH.sudoreplaces$PATHwith its ownsecure_pathby default, so aclaudeCLI installed on the invoking user's own PATH (an npm global, nvm, or similar user-local install) is invisible to the sudo'd process. The run reports "Claude Code marketplace registered: False" even on a host whereclaudeis on PATH for the actual user, and a re-run as that user reportsTruefor the identical tree.host-setup/linux/install-skills.shnever checksEUID,$SUDO_USER, or otherwise guards against this, despite its own docstring and--helptext both saying "Installs the fleet skills for the current user" (install-skills.sh:3,install-skills.sh:31-34). Nothing else inhost-setup/needssudofor this step:install-tools.shandupgrade-host.share the ones that touch system package state, andinstall-skills.shwrites only under the user's home.What this looks like in practice
Both runs exit 0, so nothing marks the first one as wrong. A user who runs the
sudo-prefixed form out of habit, since the two sibling scripts in the same stand-up flow,install-tools.shandupgrade-host.sh, both needsudo, gets an apparently successful install that the report step (install-skills.sh --report, run as themselves) still calls missing.Shapes that would close it
Not a recommendation, just what seems available:
sudo/root.install-skills.shchecksEUID(or$SUDO_USER) up front anddies with a message pointing at running it as the normal user instead, matching what its own docs already promise.$SUDO_USER(viagetent passwdor similar) when running undersudo, and readclaude_available()against that user'sPATHrather than root's, so the sudo'd and non-sudo'd runs agree.