skills/jiwenc-nv/orca/orca-cli/Gen Agent Trust Hub

orca-cli

Pass

Audited by Gen Agent Trust Hub on Aug 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local commands using the orca binary or its derivatives (orca-dev, orca-ide) to manage project state, including worktrees and terminals.
  • [DATA_EXPOSURE]: The skill reads environment variables ORCA_CLI_COMMAND and ORCA_DEV_REPO_ROOT to resolve the correct executable path.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface. Ingestion points: Instructions are retrieved from the output of ORCA skills get orca-cli as specified in SKILL.md. Boundary markers: None provided to distinguish command output from system instructions. Capability inventory: Full access to orca subcommands across all scripts, including worktree, terminal management, and browser control. Sanitization: No escaping or filtering is performed on the command output before it is interpolated into the agent context.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 2, 2026, 12:37 AM