The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides scripts (scripts/check-runtime-capabilities.mjs, scripts/validate-orca-orchestration.mjs, scripts/verify-orca-orchestration.mjs) that use Bun.spawn to execute local CLI tools such as orca, omo, gjc, and bun. These operations are limited to read-only version checks, help menu inspections, and internal package validation.
[DYNAMIC_EXECUTION]: The validation suite utilizes the Bun runtime to execute sub-processes for capability checking and integrity verification. The arguments are constrained by the scripts' logic and do not incorporate unvalidated external input into the command strings.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external agents and terminal sessions. It addresses this attack surface through explicit instructions to treat all terminal text and model output as 'untrusted evidence,' strictly forbidding the splicing of such text into executable commands and requiring manual verification before acting on external data.
[SAFE]: The skill demonstrates security best practices by explicitly prohibiting the storage or transmission of credentials and tokens in logs or prompts. It also implements a 'Parent-owned child session cleanup' policy to ensure no orphaned terminal sessions or processes remain after execution.

orca-orchestration