diff --git a/install.sh b/install.sh
index b71d6d8..ff93531 100755
--- a/install.sh
+++ b/install.sh
@@ -3,15 +3,24 @@ set -euo pipefail
 cd "$(dirname "$0")"
 
 # Auto-install auth-rt if not found
-_AUTH_RT_SRC="$HOME/.local/share/auth-runtime"
 if ! command -v auth-rt &>/dev/null && [ ! -x "$HOME/.local/bin/auth-rt" ]; then
   echo "auth-rt not found, installing..."
-  if [ -d "$_AUTH_RT_SRC/.git" ]; then
-    git -C "$_AUTH_RT_SRC" pull --ff-only
+  _FORGEJO="http://192.168.0.108:3030"
+  _OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
+  _ARCH="$(uname -m)"; case "$_ARCH" in x86_64) _ARCH="amd64";; aarch64) _ARCH="arm64";; esac
+  _URL="$_FORGEJO/agent-skills/auth-runtime/releases/download/latest/auth-rt-${_OS}-${_ARCH}"
+  mkdir -p "$HOME/.local/bin"
+  if curl -fsSL "$_URL" -o "$HOME/.local/bin/auth-rt" 2>/dev/null; then
+    chmod +x "$HOME/.local/bin/auth-rt"
+    echo "auth-rt installed (downloaded)"
   else
-    git clone --depth 1 http://192.168.0.108:3030/agent-skills/auth-runtime.git "$_AUTH_RT_SRC"
+    echo "Download failed, building from source..."
+    _SRC="$HOME/.local/share/auth-runtime"
+    if [ -d "$_SRC/.git" ]; then git -C "$_SRC" pull --ff-only
+    else git clone --depth 1 "$_FORGEJO/agent-skills/auth-runtime.git" "$_SRC"
+    fi
+    bash "$_SRC/install.sh"
   fi
-  bash "$_AUTH_RT_SRC/install.sh"
 fi
 
 echo "Building 1688-product-master..."
diff --git a/src/auth-cli.ts b/src/auth-cli.ts
index d2ee555..d072a88 100644
--- a/src/auth-cli.ts
+++ b/src/auth-cli.ts
@@ -2,11 +2,12 @@
  * Thin CLI wrapper for auth-runtime.
  *
  * Copy this file into your skill's src/ directory. It calls the
- * `auth-rt` binary (compiled from auth-runtime), so the skill has
- * zero npm dependency on @clawd/auth-runtime.
+ * `auth-rt` binary (a standalone Go executable), so the skill has
+ * zero npm/runtime dependency on auth-runtime.
  *
  * Prerequisites:
- *   ~/.openclaw/bin/auth-rt must exist (run auth-runtime/install.sh)
+ *   `auth-rt` must be in PATH or at ~/.local/bin/auth-rt
+ *   (install.sh handles this automatically)
  *
  * Usage:
  *   import { createSkillClient } from './auth-cli.ts';
@@ -20,7 +21,14 @@ import * as os from 'os';
 
 const home = process.env.HOME || os.homedir();
 const AUTH_RT_BIN = process.env.AUTH_RT_BIN
-  || path.join(home, '.local', 'bin', 'auth-rt');
+  || (() => {
+    // Check if auth-rt is in PATH
+    const which = spawnSync('which', ['auth-rt'], { encoding: 'utf-8' });
+    if (which.status === 0 && which.stdout.trim()) {
+      return which.stdout.trim();
+    }
+    return path.join(home, '.local', 'bin', 'auth-rt');
+  })();
 
 export interface ApiResponse {
   status: number;