The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to "re-run it with escalated permissions" if it fails with a runtime_access_denied error. This is a direct prompt for the AI to attempt to bypass environment-imposed security boundaries or sandbox restrictions.
[COMMAND_EXECUTION]: The skill executes local binaries including orca, orca-ide, and orca-dev. It directs the agent to resolve the binary path using environment variables like ORCA_CLI_COMMAND, which could be exploited if the environment is compromised to point to a malicious executable.
[DYNAMIC_EXECUTION]: The skill uses the command ORCA skills get orca-cli to fetch its operational guide at runtime. This behavior allows the skill to load and execute instructions that are not present in the static SKILL.md file, making the final behavior of the agent unverifiable during static analysis.
[INDIRECT_PROMPT_INJECTION]: The skill creates a vulnerability surface by ingesting external data from a CLI tool and treating it as instructions.
Ingestion points: The content returned by ORCA skills get orca-cli (SKILL.md).
Boundary markers: The skill lacks delimiters or warnings to the agent to treat the fetched guide as untrusted or to ignore embedded instructions within that guide.
Capability inventory: The skill provides the agent with capabilities to operate terminals, manage worktrees, control an embedded browser, and interact with the filesystem via the CLI.
Sanitization: No sanitization or validation is performed on the output of the CLI before it is loaded into the agent's context.

orca-cli