The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The instructions explicitly tell the agent to "re-run it with escalated permissions" if it encounters a runtime_access_denied error, which is a direct instruction to bypass security sandbox restrictions.
[INDIRECT_PROMPT_INJECTION]: The skill uses ORCA skills get orca-cli to load a "version-matched guide" into the agent's context. This guide contains instructions that the agent is told to follow, creating an attack surface where the tool's output can control the agent's future actions.
Ingestion points: The output of the ORCA skills get orca-cli command is loaded as the primary guide in SKILL.md.
Boundary markers: There are no boundary markers or instructions to treat the loaded guide as untrusted data.
Capability inventory: The orca tool description indicates it can manage terminals, repositories, automations, and an embedded browser.
Sanitization: No sanitization or validation of the fetched guide is performed before the agent acts on its instructions.
[DYNAMIC_EXECUTION]: The skill's operational logic is not fully contained in the provided file; it dynamically loads its primary instructional body ("the guide") from the orca executable at runtime.
[COMMAND_EXECUTION]: The skill instructs the agent to execute various CLI binaries (orca, orca-dev, orca-ide) and environment-variable-defined commands (ORCA_CLI_COMMAND) based on environment variables and local path detection.

orca-cli