orca-identity-review
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses established platform tools to retrieve cloud asset data, effective permissions, and CloudTrail logs (CDR). These operations are well-defined and within the expected scope of a security analysis tool.
- [COMMAND_EXECUTION]: The skill provides a feature to generate remediation code (Terraform, CloudFormation, Ansible, Shell scripts, etc.) and save it to local files. This is consistent with its primary purpose of helping users fix identified security gaps.
- [PROMPT_INJECTION]: The skill processes external data from cloud logs and identity policies. While this creates an indirect prompt injection surface (Category 8), the risk is considered safe because the skill operates on structured tool outputs and its analytical logic is designed for technical auditing rather than autonomous execution of the ingested data.
Audit Metadata