Multica Skill Importer
Reliably import skills into a Multica workspace from URLs or local files, then bind them to agents.
The skill requires explicit user intent, uses controlled CLI commands (multica skill import) and structured output; conflict handling is safe by default (fail), overwrite requires explicit user choice and is creator-only, with rollback guarantees like preserving IDs and bindings. It explicitly forbids bypassing Multica management via npx skills add. Potential risks: the skill allows executing arbitrary multica commands, affecting workspace data, but the default fail strategy and explicit on-conflict options mitigate this. Missing guidance on sensitive data handling, though the skill itself doesn't involve exfiltration. Score 12 due to room for improvement in permission control and data-flow transparency.
Skill instructions are clearly mapped to source code, with detailed command-line examples and error-handling flows. However, static review cannot verify execution, and line numbers may drift, though re-verification methods are provided. It handles abnormal cases (e.g., old server formats) but lacks test coverage and complete failure-feedback validation. Score 10, the static-review cap.
The skill clearly defines its scope: only when the user provides a URL or import target, not for choosing skills. It supports multiple URL sources (clawhub, skills.sh, github) and local archive imports, showing good environment fit. However, it does not address mainland-China network reachability, and its dependent hosts may be inaccessible; this needs caveats. Trigger conditions are clear, but boundary descriptions could be refined. Score 12.
SKILL.md is well-structured with frontmatter (name, description, allowed-tools), usage instructions, examples, and references. However, it lacks versioning, changelog, and explicit maintenance responsibility. License information is in the repository but not in the skill itself. It provides a source map for maintainability. Score 12.
The skill provides clear import steps and verification methods, guiding users through skill import and agent binding. However, static review cannot verify actual execution, and the output format depends on real CLI responses, so users must check output. There's no evidence of comparative advantage over manual methods. Score 5, the static-review cap.
The skill includes a source map linking each behavior to specific code locations and provides re-verification commands. However, these are internal repository materials without independent external validation or authenticity proofs. Score 5, the static-review cap.
- Static review cannot verify execution; the skill depends on hosts (clawhub.ai, skills.sh, github.com) that may be inaccessible from mainland China networks; users should confirm.
- The skill permits executing multica commands, which may affect workspace data; users are advised to use the default --on-conflict fail strategy and enable explicit confirmation when needed.
- The skill does not detail sensitive data handling; users using the overwrite strategy should ensure they are the original creator to avoid overwriting others' skills.
What does this skill do, and when should you use it?
This skill imports skills into a Multica workspace from hosted sources (ClawHub, skills.sh, GitHub) or local .skill/.zip archives. It uses the multica CLI to hit the workspace import endpoint, handles conflict strategies, and verifies agent binding. It's designed to avoid common pitfalls like using npx skills add which bypasses Multica management. The skill provides verified steps and encourages reading the source map for detailed traceability.
Runs the multica skill import --url or --file command to install skills into the Multica workspace database. It supports URLs from ClawHub, skills.sh, and GitHub, and local .skill/.zip files. The skill processes --on-conflict strategies (fail, overwrite, rename, skip), parses the structured response, and binds skills to agents using multica agent skills add and list. It verifies that the target skill ID is present after binding and avoids using npx skills add.
- A user provides a ClawHub or skills.sh URL and wants to add that skill to their workspace.
- A user wants to import a skill from a GitHub repository, possibly a specific directory or SKILL.md file.
- A user has a local .skill file (e.g., packaged from Anthropic's skill-creator) and wants to upload it to Multica.
- A user wants to assign an imported skill to a specific agent while preserving existing skill assignments.
- A user needs to handle a name conflict, e.g., importing with rename or overwriting an existing skill.
- A user is unsure if an import succeeded and wants to verify the skill ID in the response.
What are this skill's strengths and limitations?
- Ensures skills are actually installed in the Multica workspace database, not a local environment.
- Supports multiple source types: ClawHub, skills.sh, GitHub URLs, and local .skill/.zip files.
- Provides clear conflict strategies (fail, overwrite, rename, skip) to protect existing skills.
- Offers clear traceability via structured JSON responses and explicit verification steps.
- Built-in zip-slip protection and file size limits.
- Only applicable to the Multica ecosystem; requires the multica CLI to be installed and configured.
- Requires network access for URL imports and access to the hosted sources (GitHub, skills.sh, ClawHub).
- Conflict handling may require manual recovery if older servers return a simple string instead of structured existing_skill.
- No evidence of a test suite is provided.
How do you install this skill?
The skill is a built-in skill in the Multica repository (server/internal/service/builtin_skills/multica-skill-importing/SKILL.md). After installing the Multica CLI (e.g., brew install multica-ai/tap/multica), it should be available through its skill directory framework. How exactly to activate the SKILL.md into a workspace is not explicitly documented in the source—see the repo documentation for installation steps.
How do you use this skill?
Prompt in a Multica environment: e.g., 'import the skill from https://skills.sh/acme/repo/review-helper'. The skill will run: multica skill import --url <URL> --output json, then optionally multica agent skills add <agent-id> --skill-ids <skill-id> --output json. Refer to the SKILL.md for command examples for all options and conflict handling.
How does this skill compare with similar options?
Compared to generic skill installers like npx skills add, this skill is specific to Multica: it writes to the workspace database so Multica can manage the skill. The source explicitly discourages using npx skills add as a final install method.