orca-per-workspace-env
Warn
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions depend on the agent executing a local binary (resolved as
orca,orca-ide, ororca-dev) to perform setup and validation tasks. - [DYNAMIC_EXECUTION]: The skill uses the command
ORCA skills get orca-per-workspace-envto fetch and load dynamic guides/instructions from a local executable into the agent's session context, which can lead to the execution of unverified logic if the binary is compromised. - [PRIVILEGE_ESCALATION]: The instructions explicitly direct the agent to "re-run it with escalated permissions" in response to a
runtime_access_deniederror, encouraging the agent to bypass standard environment restrictions and acquire higher privileges.
Audit Metadata