orca-onboard

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The HTTPS GitHub repo (https://github.com/rheinmir/setup.git) is cloned and its install script is executed by the skill; because it is an external repo from an unknown user and may run arbitrary install scripts, it represents a potential risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill explicitly sends local project files to external model services (opencode/Claude), clones and executes remote bootstrap/install scripts, and includes an automated git push flow — collectively creating high risk for unintended data exfiltration and supply‑chain/backdoor compromise.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). High likelihood because Phase 3/4 passes outsider-authored repo text into an LLM (e.g., Phase 3 Wiki Generation reads .understand-anything/ONBOARDING.md and injects it into the opencode run "$SPEC" model prompt; those files originate from scanning/analyzing the target codebase, which can include outsider-authored content), so free text from non-chosen authors can end up in model context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill clones and uses remote repository content at runtime—e.g. it runs "git clone https://github.com/rheinmir/setup.git /tmp/orca-llmwiki-bootstrap" and then invokes "bash /tmp/orca-llmwiki-bootstrap/harness/scripts/install-harness.sh", and also later clones "git@github.com:rheinmir/setup.git" for syncing—so fetched remote code is executed and required for bootstrap.