orca-runs
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a command using the
orcaCLI to create a new terminal tab and run a Node.js script (view.mjs) located in a sibling skill's directory. - [EXTERNAL_DOWNLOADS]: During its initial setup, the run view component installs the
terminal-kitpackage from the NPM registry usingnpm ci. 'terminal-kit' is a well-known library for creating interactive terminal user interfaces. - [INDIRECT_PROMPT_INJECTION]: The skill processes run data from a local JSONL registry (
~/.claude/orca-runs.jsonl). While this file is populated by external run data, the skill uses thedisable-model-invocation: trueflag, which prevents the agent from interacting with the dashboard's output or being influenced by embedded instructions during operation.
Audit Metadata