The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill includes an explicit instruction to the agent to bypass sandbox restrictions: "If it fails with runtime_access_denied, your sandbox blocked the connection: re-run it with escalated permissions."
[COMMAND_EXECUTION]: The skill is centered around executing a local CLI utility (orca, orca-ide, or orca-dev) and interacting with system components like terminals, worktrees, and an embedded browser.
[DYNAMIC_EXECUTION]: The skill instructions specify that the agent must run ORCA skills get orca-cli to load a "version-matched guide" at runtime, effectively executing dynamically retrieved instructions.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection if the local CLI output is manipulated.
Ingestion points: The output of the ORCA skills get orca-cli command described in SKILL.md is ingested into the agent's context to guide subsequent actions.
Boundary markers: The instructions lack boundary markers or warnings to ignore potentially malicious instructions embedded in the fetched guide.
Capability inventory: The agent is granted capabilities to manage file system worktrees, send/read terminal data, and operate a browser via the CLI.
Sanitization: No sanitization or validation is performed on the content retrieved from the CLI before it is used to influence agent behavior.

orca-cli