- v0.9.8 β released 2026-06-02
+ v0.9.9 β released 2026-06-08
SKELETONKEY
@@ -227,7 +227,7 @@ uid=0(root) gid=0(root)
β
CISA KEV prioritized
- 12 of 36 CVEs in the corpus are in CISA's Known Exploited
+ 13 of 36 CVEs in the corpus are in CISA's Known Exploited
Vulnerabilities catalog β actively exploited in the wild.
Refreshed on demand via tools/refresh-cve-metadata.py.
@@ -600,7 +600,7 @@ uid=0(root) gid=0(root)
who found the bugs.
diff --git a/install.sh b/install.sh
index a1c725d..a503981 100755
--- a/install.sh
+++ b/install.sh
@@ -28,7 +28,11 @@ set -eu
REPO="${SKELETONKEY_REPO:-KaraZajac/SKELETONKEY}"
VERSION="${SKELETONKEY_VERSION:-latest}"
-PREFIX="${SKELETONKEY_PREFIX:-/usr/local/bin}"
+# PREFIX resolution is deferred until install time so we can pick a
+# sudo-free default. SKELETONKEY is a privilege-escalation tool β by
+# definition the operator does NOT have root yet, so the installer must
+# NEVER need sudo. Empty here means "auto-pick a writable dir below".
+PREFIX="${SKELETONKEY_PREFIX:-}"
log() { printf '[\033[1;36m*\033[0m] %s\n' "$*" >&2; }
ok() { printf '[\033[1;32m+\033[0m] %s\n' "$*" >&2; }
@@ -108,29 +112,49 @@ fi
chmod +x "$tmp/skeletonkey"
-# Install. Try $PREFIX directly; if not writable, sudo.
-target_path="$PREFIX/skeletonkey"
-if [ -w "$PREFIX" ] || [ "$(id -u)" -eq 0 ]; then
- mv "$tmp/skeletonkey" "$target_path"
-elif command -v sudo >/dev/null 2>&1; then
- log "$PREFIX needs sudo; you may be prompted for password"
- sudo mv "$tmp/skeletonkey" "$target_path"
+# Choose install dir β NEVER escalate to sudo. If the user pinned
+# SKELETONKEY_PREFIX we honor it exactly (creating it if needed) and
+# error rather than escalate when it isn't writable. Otherwise prefer
+# /usr/local/bin only when it happens to already be writable, and fall
+# back to a guaranteed per-user dir ($HOME/.local/bin) that needs no
+# privileges. This keeps `curl ... | sh` password-free for the exact
+# users this tool is meant for: unprivileged accounts.
+if [ -n "$PREFIX" ]; then
+ [ -d "$PREFIX" ] || mkdir -p "$PREFIX" 2>/dev/null \
+ || fail "cannot create SKELETONKEY_PREFIX=$PREFIX"
+ [ -w "$PREFIX" ] || fail "SKELETONKEY_PREFIX=$PREFIX not writable (the installer never uses sudo β pick a writable dir)"
+elif [ -w /usr/local/bin ]; then
+ PREFIX=/usr/local/bin
else
- fail "$PREFIX not writable and sudo not available. Try SKELETONKEY_PREFIX=\$HOME/.local/bin"
+ PREFIX="${XDG_BIN_HOME:-$HOME/.local/bin}"
+ mkdir -p "$PREFIX" 2>/dev/null || fail "cannot create $PREFIX"
fi
+target_path="$PREFIX/skeletonkey"
+mv "$tmp/skeletonkey" "$target_path" || fail "failed to install to $target_path"
ok "installed: $target_path"
+
+# ~/.local/bin is frequently absent from PATH on fresh accounts β tell
+# the user how to invoke it rather than letting `skeletonkey` 404.
+case ":$PATH:" in
+ *":$PREFIX:"*) : ;;
+ *) log "note: $PREFIX is not on \$PATH β run it as $target_path, or add the dir to PATH" ;;
+esac
+
"$target_path" --version
cat >&2 <