orca-plugin

SUSPICIOUS. The skill’s trading capabilities fit its stated Orca/Solana purpose and its data flows mostly target expected OKX, GitHub, Orca, and Solana endpoints. The main concern is install trust: it downloads a prebuilt plugin binary and launcher, plus installs other skills transitively, so the effective execution footprint is larger and less verifiable than the visible markdown alone. Confirmation gates materially reduce abuse risk, but the combination of financial transaction capability and black-box binary installation keeps overall risk high.