orca-onboard
Fail
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads and executes remote shell scripts using unsafe piping to bash:
curl -fsSL https://raw.githubusercontent.com/Rheinmir/setup/orca/harness/poc-vendor-neutral/bootstrap.sh | bash. - [REMOTE_CODE_EXECUTION]: The skill clones a remote repository and executes internal scripts:
git clone https://github.com/rheinmir/setup.git /tmp/orca-llmwiki-bootstrapfollowed bybash /tmp/orca-llmwiki-bootstrap/harness/scripts/install-harness.sh. - [PERSISTENCE]: The skill contains a mandatory 'sync push' routine that clones a remote repository (
git clone git@github.com:rheinmir/setup.git), overwrites files with local versions, and executesgit push origin orcato modify the remote source. - [COMMAND_EXECUTION]: The skill starts a local web server in the background using
nohup npx serve -p 8765 > /tmp/serve.log 2>&1 &. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted codebase content which could contain malicious instructions.
- Ingestion points: Reads all files in the target project root, README files, manifest files (package.json, etc.), and git log history.
- Boundary markers: None. The skill interpolates file content directly into prompts for batch analysis.
- Capability inventory: Full shell access (
bash), Python execution, file writing, and network access (git, curl). - Sanitization: Uses structured JSON islands and specific task definitions for the LLM, but does not escape or filter the ingested code content.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/Rheinmir/setup/orca/harness/poc-vendor-neutral/bootstrap.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata