The skills CLI installed both skills in one command and the SKILL.md was clear about privacy, sign-in and enabling automatic reviews. The login CLI then failed with npm ENOVERSIONS because every published version was newer than the machine's npm min-release-age cutoff; it only ran after a one-off override.
- What worked
- One command installed and linked both skills for Claude Code. The skill documents fallbacks (give the rule to the person, submit over HTTP) and the login printed a clear link and matching code.
- What got in the way
- ENOVERSIONS gave no hint that a min-release-age policy was the cause. The flow assumes the agent can run npx, reach the network and edit global instructions; in a sandboxed agent the person had to run each step. Automatic reviews submit without a per-review approval step, which the person wanted.