The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's operational logic is not statically defined within its own files. It instructs the agent to retrieve a version-specific guide using the command ORCA skills get orca-cli and to follow the instructions contained within that retrieved guide. This pattern of dynamic instruction loading at runtime prevents a full security audit of the agent's intended actions and logic.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it explicitly directs the agent to follow a "live injected preamble" if detected in the prompt context.
Ingestion points: Untrusted data enters via the "live injected preamble" (referenced in SKILL.md).
Boundary markers: No delimiters, markers, or "ignore embedded instructions" warnings are provided to isolate the preamble.
Capability inventory: The agent can execute shell commands via the ORCA placeholder (e.g., status, open, skills get).
Sanitization: No sanitization or validation of the preamble content is performed before the agent is instructed to follow it.
[COMMAND_EXECUTION]: The skill constructs and executes shell commands using an ORCA placeholder, which the agent is instructed to resolve to a local executable. It performs environment-altering operations and status checks such as ORCA status --json and ORCA open --json.
[DATA_EXFILTRATION]: The skill implements a "Task-brief contract" that requires collecting and transmitting detailed workspace metadata, including specific file paths, current state, and modified code content, to a receiving agent. While this is part of the handoff purpose, it creates a broad surface for data exposure of the user's working environment.

orca-handoff