v0.0.99

squirrel setup gets you from install to your first audit in about a minute, the CLI installs and updates the agent skills itself, --no-publish really does skip the publish, and --disable-discovery-probes turns off the pre-crawl requests that got some audits banned by server firewalls.

Added

• squirrel setup: one guided first run. It signs you in (optional, local audits never need an account), installs the agent skills for Claude Code, Codex, Cursor and more (default yes), and turns on auto-update, then hands you the command for your first audit. Run it again any time: each step says when it is already done. --yes takes every default, --dry-run shows what it would do. The installers now end with one next step, squirrel setup.
• Running squirrel on its own shows a quick start and every command grouped by what it is for (audits, agents, cloud, settings), in place of a flat list that ended in ERROR No command specified. squirrel --help, group help such as squirrel self, and each command's --help use the same layout, with examples.
• The CLI, install.sh and install.ps1 share one header: the pixel squirrel from squirrelscan.com, in the site's colours. It uses truecolor or 256 colours depending on what the terminal supports, a plain silhouette with NO_COLOR or piped output, and text alone without UTF-8.
• squirrel feedback works without a terminal, so an agent or a script can send it. Pass the text with -m/--message, as plain words, or piped on stdin and it sends without a single prompt. --json prints one result object and, on any failure, exits 1 with an error code and the web form's URL. --run-id and --website-id say which audit or site it is about, and --email sets the reply address, which otherwise falls back to the one you last gave, then your signed-in account's. At a terminal with no text it asks, as before.
• send_feedback on squirrel mcp: the local server gets the feedback tool the hosted one already had, sent through the same path as squirrel feedback.
• squirrel audit --disable-discovery-probes, or [crawler] disable_discovery_probes = true in squirrel.toml, turns off the requests an audit sends before its first page for the files agents look for: llms.txt, /.well-known/*, /openapi.json, /swagger.json, AGENTS.md, and the homepage fetched as GPTBot and Claude-User. Some firewalls ban a client for asking for /swagger.json. A common fail2ban "sensitive files" jail does exactly that, every request after it gets connection refused, and the audit fails right after it starts. robots.txt, sitemap discovery and the page you asked for still run. The flag wins over the config for one run, so --disable-discovery-probes=false sends the probes when the config turns them off. The crawler docs list every request, and how to let the audit through your firewall instead.

Changed

• Input piped to squirrel feedback is now the feedback itself, not answers to its prompts. A pipe left open and silent for 5 seconds counts as finished, so the command can't hang waiting on it.
• squirrel skills installs and updates the agent skills itself: no Node, no npx, no other tool. It reads the published manifest.json in squirrelscan/skills, downloads only the files that changed, checks every one against its sha256, and only then writes the skills to ~/.claude/skills/ ($CLAUDE_CONFIG_DIR/skills/ when set) and ~/.agents/skills/ (Codex, Cursor, Gemini CLI and other Agent Skills tools) as real copies, so it works the same on macOS, Linux and Windows. A failed or mismatched download writes nothing and leaves the previous install as it was.
• The commands: squirrel skills (the same as squirrel skills status: what is installed where against the latest version), install [skill...] [--agent claude|agents|all] [--project] [--dry-run], update [skill...] [--check] [--force] [--dry-run] [--json] and uninstall [skill...] [--agent ...] [--project], which removes only what squirrel wrote. update --check exits 1 when an update is available, and 2 when the check itself fails, for scripts and agents. --project means the repo you run it in (the nearest folder with a .git), and each repo's copies are updated from inside that repo.
• A skill file you edited is never overwritten silently. squirrel records the hash of every file it writes; update keeps an edited file and says so, and --force replaces it after backing your copy up to ~/.squirrel/skills/backups/. Your own files in a skill folder stay put.
• Skills installed earlier with npx skills are taken over: squirrel updates them in place, replaces the symlinks npx skills made with copies, and removes them from its lock file after copying it to .skill-lock.json.bak, so the two tools stop updating the same folders. A skill folder that links elsewhere, such as your own checkout, or that holds another author's skill of the same name, is left alone.
• Auto-update keeps the installed skills current. On the first run after the CLI updates itself, a background job updates the skills you already have (never one you don't, and never inside a repo): no prompts, edits kept, once per version, a 60 second limit, and no network at all when none are installed. It follows auto_update, is off in CI and with SQUIRREL_NO_UPDATE, and squirrel self settings set skills_auto_update false turns off just the skills. It runs after the update has landed, so it can never fail or delay it.
• The agent skills and agent plugins have one home: squirrelscan/skills. This repo no longer carries copies: its skills/ directory and the Claude Code, Cursor and Agent Plugins manifests are gone. The Claude Code plugin (/plugin marketplace add squirrelscan/skills), the Cursor plugin and the Agent Plugins package each bundle both skills with the hosted MCP server there. None carries a version, so Claude Code versions its plugin by commit and every change to the skills reaches plugin users without a CLI release.
• If you added the squirrelscan/squirrelscan Claude Code marketplace, it keeps working: its plugin entry now points at squirrelscan/skills, so /plugin marketplace update squirrelscan then /plugin update squirrelscan@squirrelscan moves you over. The Cursor plugin can't redirect that way; install it from squirrelscan/skills.
• The discovery probes follow your rule selection. A probe goes out only when a rule that reads it is going to run, so --rule-exclude ax sends none of them and --rule-exclude ax/api-discovery leaves out the OpenAPI, Swagger and OAuth paths.
• The discovery probes queue behind per_host_concurrency and per_host_delay_ms like every page does. They used to go out 20 at a time, whatever those were set to, so a polite crawl was polite everywhere except in its first second. They are plain requests, so they keep those settings when cloud rendering loads pages one at a time.
• An agent experience check whose probe was not sent, or whose probe for a file like /llms.txt or /.well-known/mcp.json got no answer (a refused connection from a firewall that just banned the audit, or a timeout), says "not checked" (value not-checked) instead of reporting the file missing, and is not scored.

Fixed

• squirrel skills install works again. In v0.0.98 it stopped with "No valid skills found" once the skills moved to their own repository; it now installs them from squirrelscan/skills directly.
• A mistyped command now says what you probably meant (squirrel audti suggests squirrel audit, squirrel skills instal suggests squirrel skills install) and exits 1 without a stack trace. A missing argument shows the command's usage and an example, and a command group run on its own (squirrel self) shows its help and exits 0.
• squirrel -c <path> <command> works: the config path given before the command was read as the command name ("Unknown command").
• squirrel skills update updates the skills. It used to pass a repository to npx skills update, which reads its arguments as skill names, so it matched nothing installed and changed nothing.
• squirrel audit --no-publish skips the publish. The flag never reached the command, so a signed-in run published anyway, or ended in "Could not auto-publish" when the connection failed. --no-publish together with --publish (or -p) now stops with an error before the audit starts, whatever the order. Before, the pair was accepted and --no-publish ignored.