diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index 1113a67..e103d9e 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -10,5 +10,7 @@
   "homepage": "https://www.hotdata.dev",
   "repository": "https://github.com/hotdata-dev/hotdata-cli",
   "license": "MIT",
+  "privacyPolicyUrl": "https://www.hotdata.dev/privacy-policy",
+  "termsOfServiceUrl": "https://www.hotdata.dev/terms-of-service",
   "icon": "./.claude-plugin/icon.png"
 }
diff --git a/README.md b/README.md
index 3998678..d780241 100644
--- a/README.md
+++ b/README.md
@@ -58,8 +58,8 @@ What the plugin runs, sends, and fetches:
 - **SessionStart hook** (`hooks/check-cli.sh`, Claude Code and Cowork only):
   checks whether `hotdata` is on `PATH` or in `~/.hotdata/cli`. If it's only in
   `~/.hotdata/cli`, it adds that folder to `PATH` for the session. If it's
-  missing, it asks Claude to offer the installer. The hook makes no network
-  requests, installs nothing, and sends no data.
+  missing, it asks Claude to offer to install the CLI. The hook makes no
+  network requests, installs nothing, and sends no data.
 - **Installer**, only after you agree: `curl -fsSL https://hotdata.dev/install |
   HOTDATA_NO_SKILLS=1 sh` downloads the CLI from this repository's GitHub
   releases, or installs it with Homebrew if `brew` is present.
diff --git a/hooks/check-cli.sh b/hooks/check-cli.sh
index 9ada0cf..2e1dfe9 100755
--- a/hooks/check-cli.sh
+++ b/hooks/check-cli.sh
@@ -3,8 +3,11 @@
 #
 # The plugin ships the skill, not the binary. Stay silent when the CLI is
 # reachable. When it isn't, stdout becomes session context asking Claude to
-# offer the installer rather than run it: piping curl into sh on every session
+# offer an install rather than run one: installing software on every session
 # start is not something users agreed to by installing a skill.
+#
+# The install command itself lives in the skill, not here, so this hook runs
+# nothing and fetches nothing that the directory's validator has to follow.
 
 set -u
 
@@ -23,15 +26,10 @@ if [ -x "$DIST_BIN_DIR/hotdata" ]; then
     exit 0
 fi
 
-# HOTDATA_NO_SKILLS=1: the plugin already provides the skill, so the installer
-# must not add a second copy to ~/.claude/skills.
 cat <<'EOF'
 The hotdata CLI is not installed. Before running any hotdata command, tell the
-user and ask whether to install it. If they agree, run:
-
-  curl -fsSL https://hotdata.dev/install | HOTDATA_NO_SKILLS=1 sh
-
-If the binary lands in ~/.hotdata/cli, call it as ~/.hotdata/cli/hotdata for the
-rest of this session.
+user and ask whether to install it. If they agree, follow the install steps in
+the hotdata skill (the "Upgrade" section of skills/hotdata/SKILL.md), and set
+HOTDATA_NO_SKILLS=1 because this plugin already provides the skill.
 EOF
 exit 0