The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs the AI agent to "re-run it with escalated permissions" if a runtime_access_denied error occurs. This encourages the agent to bypass security constraints or request administrative/sudo access during runtime.
[COMMAND_EXECUTION]: The skill relies on shell command execution to function, specifically resolving paths via environment variables (ORCA_CLI_COMMAND, ORCA_DEV_REPO_ROOT) and running local executables like orca, orca-ide, or orca-dev to fetch further instructions.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a dynamic loader for external instructions fetched via ORCA skills get computer-use. This creates a vulnerability surface for indirect prompt injection:
Ingestion points: The output of the ORCA skills get command in SKILL.md is loaded directly into the agent's session.
Boundary markers: There are no delimiters or warnings provided to the agent to treat the fetched content as untrusted or to ignore embedded instructions.
Capability inventory: The skill description grants the agent significant capabilities, including GUI control (clicks, typing, screenshots) and programmatic access via shell, filesystem, and HTTP tools.
Sanitization: No sanitization or validation of the dynamically fetched content is performed before the agent acts upon it.

computer-use