orca-cli
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions the agent to execute a local command-line interface (CLI) named
orca(or variants likeorca-ide,orca-dev,orca-cli). - The agent resolves the executable path based on environment variables or the operating system environment.
- Subcommands are used to manage local worktrees, terminals, and an embedded browser instance.
- The skill includes safety guidance to prevent accidental execution of the GNOME Orca screen reader on Linux systems.
- [PROMPT_INJECTION]: The skill implements a dynamic context loading pattern by instructing the agent to retrieve its full usage guide from the output of a local command (
ORCA skills get orca-cli). - Ingestion points: Instructions are ingested into the agent's context from the stdout of a local binary.
- Boundary markers: No explicit boundary markers or 'ignore' instructions are used for this dynamic content; the agent is told to treat the output as the authoritative guide.
- Capability inventory: The skill has the capability to execute shell commands and interact with the local file system through the Orca toolset.
- Sanitization: There is no sanitization of the guide content as it is expected to be provided by the verified local toolchain.
Audit Metadata