orca-cli
Warn
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: MEDIUMPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to re-run commands with 'escalated permissions' if it encounters a 'runtime_access_denied' error, which encourages bypassing security sandbox restrictions.\n- [INDIRECT_PROMPT_INJECTION]: The skill uses an ingestion point to dynamically load instructions from an external tool.\n
- Ingestion points: The agent is instructed to run 'ORCA skills get orca-cli' and follow the resulting output as a guide (SKILL.md).\n
- Boundary markers: No delimiters or warnings are present to prevent the agent from obeying malicious instructions embedded in the tool's output.\n
- Capability inventory: The CLI tool provides broad access to terminals, filesystems (repos and worktrees), and an embedded browser.\n
- Sanitization: No sanitization or validation of the dynamically loaded guide content is mentioned.\n- [DYNAMIC_EXECUTION]: The executable path is resolved at runtime using environment variables (ORCA_CLI_COMMAND) or local discovery (orca-dev, orca-ide). The agent then executes code (instructions) fetched from this dynamically determined path.\n- [COMMAND_EXECUTION]: The skill's primary operation involves executing local binaries with various arguments, which could be exploited if the executable path or arguments are manipulated.
Audit Metadata