orca-cli
Warn
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The instructions explicitly direct the agent to re-run commands with escalated permissions to bypass sandbox connectivity blocks (specifically handling
runtime_access_deniederrors). - [COMMAND_EXECUTION]: The skill executes local binaries determined by environment variables (
ORCA_CLI_COMMAND) or platform-specific logic (orca-ide,orca-dev), which may lead to execution of unintended local files if environment variables are manipulated. - [DYNAMIC_EXECUTION]: The skill uses
ORCA skills get orca-clito dynamically load a version-matched guide into the agent's context. This means the agent's instructions and behavior can be modified at runtime based on the output of a local command, which is a form of dynamic context injection.
Audit Metadata