feat: Agent Skills — knowledge packs compatible with Anthropic Agent Skills standard

[OneStepAt4time]

Agent Skills — Knowledge Packs

Priority: P2 (depends on Agent Profiles #3971)
Reference: multica/server/internal/handler/skill.go, multica/apps/docs/content/docs/skills.mdx

---

Overview

Skills are knowledge packs attached to agents — a SKILL.md plus optional supporting files that tell the agent "when you hit this kind of task, think and act like this." Compatible with the Anthropic Agent Skills open standard (agentskills.io).

Database Schema

CREATE TABLE skill (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    workspace_id UUID NOT NULL REFERENCES workspace(id),
    
    name TEXT NOT NULL,
    description TEXT,
    source TEXT NOT NULL DEFAULT 'local',  -- 'local' | 'github' | 'clawhub' | 'created'
    source_url TEXT,                       -- GitHub URL or ClawHub reference
    
    -- Content
    skill_md TEXT NOT NULL,  -- the SKILL.md content
    
    -- Metadata
    file_count INTEGER NOT NULL DEFAULT 1,
    total_size_bytes INTEGER,
    
    created_by UUID REFERENCES member(id),
    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

CREATE TABLE skill_file (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    skill_id UUID NOT NULL REFERENCES skill(id) ON DELETE CASCADE,
    path TEXT NOT NULL,       -- relative path within skill directory
    content TEXT NOT NULL,
    size_bytes INTEGER,
    
    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

CREATE TABLE agent_skill (
    agent_id UUID NOT NULL REFERENCES agent(id) ON DELETE CASCADE,
    skill_id UUID NOT NULL REFERENCES skill(id) ON DELETE CASCADE,
    attached_at TIMESTAMPTZ NOT NULL DEFAULT now(),
    
    PRIMARY KEY (agent_id, skill_id)
);

Import Sources

1. Created — write SKILL.md + files directly in UI
2. GitHub — paste repo URL, pull SKILL.md + directory contents
3. ClawHub — search and import from public marketplace
4. Local — daemon scans local skill directories, user picks which to import

Skill Attachment

• Skills are workspace-level resources
• Must be attached to an agent to take effect
• One agent can have multiple skills
• One skill can be attached to multiple agents
• Agent picks up skills on next task creation
• Editing skill content only affects newly created tasks

Skill File Discovery Paths

Tool	Path	Native discovery?
Claude Code	.claude/skills/	✅
Codex	$CODEX_HOME/skills/	✅
Cursor	.cursor/skills/	✅
Gemini	.agent_context/skills/	⚠️ Fallback
Others	.agent_context/skills/	⚠️ Fallback

On task dispatch, daemon copies skill files into the corresponding path for the agent's configured tool.

Skills vs MCP

• Skill = structured knowledge pack (static content + instructions)
• MCP = tool channel (connect to external services, invoke them)
• They're complementary. A skill can reference MCP tools in its instructions.

Safety

• Skills from GitHub/ClawHub may contain scripts/executable content
• Aegis does NOT sign, audit, or sandbox skill content
• Warning in UI: "review SKILL.md and every file before importing"
• Reference: "ClawHavoc" incident (Feb 2026)

API Endpoints

GET    /api/skills                         — list workspace skills
GET    /api/skills/:id                     — get skill detail + files
POST   /api/skills                         — create skill (from content)
POST   /api/skills/import/github           — import from GitHub URL
POST   /api/skills/import/clawhub          — import from ClawHub
POST   /api/skills/import/local            — list local skills available for import
PATCH  /api/skills/:id                     — update skill content
DELETE /api/skills/:id                     — delete skill

GET    /api/agents/:id/skills              — list agent's attached skills
POST   /api/agents/:id/skills              — attach skill to agent
DELETE /api/agents/:id/skills/:skillId    — detach skill from agent

Acceptance Criteria

1. CRUD for skills works (create, update, delete)
2. Import from GitHub URL works
3. Attach/detach skills to/from agents
4. Skill files copied to correct path on task dispatch
5. Agent receives skill content in system prompt
6. Editing skill only affects new tasks, not running ones
7. npm run gate passes

E2E Test Requirements

1. Create skill with SKILL.md → verify in list
2. Import from GitHub → verify files pulled
3. Attach to agent → create task → verify skill files in working directory
4. Edit skill → create new task → verify new content used
5. Detach skill → verify no longer included in task

Multica Source Reference

• server/internal/handler/skill.go — skill handlers
• server/internal/handler/skill_create.go — import/create logic
• server/pkg/db/queries/skill.sql — DB queries

[OneStepAt4time]

Closing in favor of Boss's consolidated spec. See #3982 (Autopilots), #3981 (Squads), #3985 (Inbox), #3983 (Chat), #3979 (Skills).