diff --git a/install.sh b/install.sh
index bb1b3ff..c324683 100755
--- a/install.sh
+++ b/install.sh
@@ -2,6 +2,11 @@
 set -euo pipefail
 cd "$(dirname "$0")"
 
-# Always fetch latest git dependencies
-rm -rf node_modules/@clawd
+# Prerequisite: auth-runtime must be cloned at ~/clawd/skills/auth-runtime
+if [ ! -d "$HOME/clawd/skills/auth-runtime/src" ]; then
+  echo "ERROR: auth-runtime not found at ~/clawd/skills/auth-runtime"
+  echo "Run: git clone http://192.168.0.108:3030/agent-skills/auth-runtime.git ~/clawd/skills/auth-runtime"
+  exit 1
+fi
+
 npm install
diff --git a/package.json b/package.json
index efaf610..6a55579 100644
--- a/package.json
+++ b/package.json
@@ -18,7 +18,6 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1004.0",
-    "@clawd/auth-runtime": "git+http://192.168.0.108:3030/agent-skills/auth-runtime.git",
     "@clawd/r2-upload": "git+http://192.168.0.108:3030/agent-skills/r2-upload.git"
   }
 }
diff --git a/src/auth-cli.ts b/src/auth-cli.ts
new file mode 100644
index 0000000..77c09a9
--- /dev/null
+++ b/src/auth-cli.ts
@@ -0,0 +1,111 @@
+/**
+ * Thin CLI wrapper for auth-runtime.
+ *
+ * Copy this file into your skill's src/ directory. It spawns
+ * `bun run <auth-runtime>/src/cli.ts` as a subprocess, so the
+ * skill has zero npm dependency on @clawd/auth-runtime.
+ *
+ * Usage:
+ *   import { createSkillClient } from './auth-cli.ts';
+ *   const client = createSkillClient();
+ *   const res = await client.post('/ecom/tasks/scrape', { url: '...' });
+ */
+
+import { spawnSync } from 'child_process';
+import * as path from 'path';
+import * as os from 'os';
+
+const AUTH_RUNTIME_DIR = process.env.AUTH_RUNTIME_DIR
+  || path.join(os.homedir(), 'clawd', 'skills', 'auth-runtime');
+const CLI_ENTRY = path.join(AUTH_RUNTIME_DIR, 'src', 'cli.ts');
+
+export interface ApiResponse {
+  status: number;
+  body: string;
+}
+
+export interface SessionResponse {
+  accessToken: string;
+  expiresIn: number;
+  ownerSessionToken?: string;
+  hookUrl?: string;
+  hookToken?: string;
+}
+
+export interface SkillClientOptions {
+  apiBase?: string;
+  dryRun?: boolean;
+}
+
+function runCli(...args: string[]): string {
+  // Use the same bun binary that's running this process
+  const bun = process.execPath;
+  const result = spawnSync(bun, ['run', CLI_ENTRY, ...args], {
+    cwd: AUTH_RUNTIME_DIR,
+    encoding: 'utf-8',
+    timeout: 60_000,
+  });
+
+  if (result.error) {
+    throw new Error(`auth-cli spawn failed: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    throw new Error(`auth-cli failed (exit ${result.status}): ${(result.stderr || '').trim()}`);
+  }
+  return (result.stdout || '').trim();
+}
+
+export class SkillClient {
+  private readonly apiBase?: string;
+  private readonly dryRun: boolean;
+
+  constructor(options: SkillClientOptions = {}) {
+    this.apiBase = options.apiBase;
+    this.dryRun = options.dryRun ?? false;
+  }
+
+  async session(): Promise<SessionResponse> {
+    if (this.dryRun) {
+      return { accessToken: '<dry-run-token>', expiresIn: 900 };
+    }
+    return JSON.parse(runCli('session'));
+  }
+
+  async get(urlPath: string): Promise<ApiResponse> {
+    return this.request('GET', urlPath);
+  }
+
+  async post(urlPath: string, body?: unknown): Promise<ApiResponse> {
+    return this.request('POST', urlPath, body);
+  }
+
+  async put(urlPath: string, body?: unknown): Promise<ApiResponse> {
+    return this.request('PUT', urlPath, body);
+  }
+
+  async patch(urlPath: string, body?: unknown): Promise<ApiResponse> {
+    return this.request('PATCH', urlPath, body);
+  }
+
+  async delete(urlPath: string, body?: unknown): Promise<ApiResponse> {
+    return this.request('DELETE', urlPath, body);
+  }
+
+  private async request(method: string, urlPath: string, body?: unknown): Promise<ApiResponse> {
+    if (this.dryRun) {
+      return { status: 200, body: JSON.stringify({ dryRun: true, method, path: urlPath }) };
+    }
+    const args = ['request', method, urlPath];
+    if (body != null) {
+      args.push('--body', JSON.stringify(body));
+    }
+    if (this.apiBase) {
+      args.push('--api-base', this.apiBase);
+    }
+    return JSON.parse(runCli(...args));
+  }
+}
+
+export function createSkillClient(options?: SkillClientOptions): SkillClient {
+  return new SkillClient(options);
+}
diff --git a/src/index.ts b/src/index.ts
index 693ec64..9214066 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,5 +1,5 @@
 import type { EmailDraft, ExportResult, ExportedFile, FetchResult } from './types.js';
-import { createSkillClient } from '@clawd/auth-runtime';
+import { createSkillClient } from './auth-cli.ts';
 import { fetchLeadDataset } from './lead-dataset.js';
 import { draftToEml, emlFilename } from './eml.js';
 import { loadR2Config, uploadToR2 } from '@clawd/r2-upload';
diff --git a/src/lead-dataset.ts b/src/lead-dataset.ts
index a156cd3..499b527 100644
--- a/src/lead-dataset.ts
+++ b/src/lead-dataset.ts
@@ -1,5 +1,5 @@
 import type { LeadDatasetResponse } from './types.js';
-import type { SkillClient } from '@clawd/auth-runtime';
+import type { SkillClient } from './auth-cli.ts';
 
 /**
  * Fetch lead-dataset from a completed cold-outreach workflow.