The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses vendor-specific tools via the Bash(multica *) capability to perform workspace operations, such as creating projects, generating issues, and adding autopilot triggers. This is consistent with the skill's stated purpose of workspace coordination.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface where data from an external kickoff profile is interpolated into a shell command. The Member IANA timezone is retrieved and passed directly to the multica autopilot trigger-add --timezone <IANA> command. * Ingestion points: The Member IANA timezone field within the kickoff profile block. * Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat this field as untrusted or to ignore embedded instructions. * Capability inventory: The skill has access to shell command execution via the Bash(multica *) tool. * Sanitization: The instructions do not specify any validation, filtering, or escaping for the timezone variable before it is interpolated into the shell command string.

multica-onboarding