The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions explicitly direct the agent to re-run commands with escalated permissions (e.g., sudo or administrative rights) if a 'runtime_access_denied' error is encountered. This encourages the agent to bypass security boundaries and provides a path for elevated execution of potentially untrusted or unverified tools.
[COMMAND_EXECUTION]: The skill relies on executing a local CLI tool resolved through a hierarchy of environment variables (ORCA_CLI_COMMAND, ORCA_DEV_REPO_ROOT) and local paths (orca-ide, orca). This mechanism can be exploited if an attacker manipulates the environment variables to point to a malicious binary.
[INDIRECT_PROMPT_INJECTION]: The skill serves as a 'discovery stub' that loads a 'version-matched guide' using the 'ORCA skills get' command. This creates a vulnerability where the content returned by the external tool, which the agent is instructed to follow, is not sanitized and lacks boundary markers to prevent the execution of embedded instructions.
Ingestion points: The output of the command 'ORCA skills get orca-emulator-android' is ingested to provide the operational logic for the session (SKILL.md).
Boundary markers: There are no delimiters or warnings to ignore embedded instructions within the content fetched from the external CLI tool.
Capability inventory: The skill description indicates broad capabilities, including ADB control, application installation, logcat access, accessibility tree interaction, and hardware button simulation.
Sanitization: No sanitization, validation, or filtering is performed on the content retrieved from the external source before the agent processes it.
[DYNAMIC_EXECUTION]: The skill uses a local executable to dynamically retrieve and load the actual instructional guide at runtime, rather than providing the instructions statically within the skill files.
[EXTERNAL_DOWNLOADS]: The 'skills get' command pattern represents a staged loading process where external content is fetched and executed/followed by the agent, potentially from unverified remote sources managed by the CLI tool.

orca-emulator-android