The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/sync_skills.py script executes the multica CLI tool using subprocess.run. The command is constructed using a list of arguments, which is a secure practice to prevent shell injection, though it does include values sourced from a user-provided manifest file.
[REMOTE_CODE_EXECUTION]: The SKILL.md file provides installation instructions for the multica CLI that involve piping a shell script from the official multica-ai GitHub repository and piping it directly to bash. While this is a common pattern for platform tooling, it represents a remote code execution vector.
[EXTERNAL_DOWNLOADS]: The skill is configured to download content from external domains such as github.com and clawhub.ai based on the sources defined in the manifest.local.json synchronization list.
[DATA_EXFILTRATION]: The skill reads local file content from paths specified in its manifest and transmits this data to the Multica platform's backend services via the CLI's import function. This behavior is the primary intended function of the skill for workspace synchronization.

multica-skill-update