The Agent Skills Directory

[PROMPT_INJECTION]: The adapter CLI in adapter/cli.py explicitly includes the --dangerously-skip-permissions flag when creating Claude terminals. This pattern is designed to instruct the agent to ignore standard safety filters and permission boundaries.
[COMMAND_EXECUTION]: The workflow runner (runner/engine.py) and queue manager (runner/queue.py) execute arbitrary shell commands defined in YAML workflow files. These commands are executed via subprocess.Popen and subprocess.run using sh -c (or a user-defined shell). While this is the primary purpose of the skill, the execution of unvalidated configuration logic poses a high risk of local code execution if workflow files are manipulated.
[PRIVILEGE_ESCALATION]: The inclusion of the --dangerously-skip-permissions flag represents a deliberate attempt to acquire or exercise capabilities that bypass the agent's standard restricted environment and security controls.
[DATA_EXFILTRATION]: The skill accesses sensitive local data by reading LLM interaction logs, session metadata, and rate limit info from ~/.claude/projects/ and ~/.codex/sessions/ (adapter/cost.py and adapter/budget.py). This data is processed and can be written to disk in the run state directory.
[INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect injection by ingesting data from external YAML workflows and Markdown templates.
Ingestion points: Workflow files, queue configurations, and Markdown spec templates (adapter/cli.py, runner/queue.py).
Boundary markers: Missing; the skill uses simple string interpolation for parameters and environment variables.
Capability inventory: Extensive use of subprocess to execute arbitrary shell commands across multiple modules (engine.py, queue.py, orca.py).
Sanitization: Largely absent; the interpolate function in adapter/cli.py performs raw string replacement of parameters into content that is subsequently processed or executed.

orca-orchestration