orca-onboard

SUSPICIOUS. The core codebase-onboarding behavior is plausible, but the skill mixes that with transitive skill installation, remote clone-and-execute bootstrap, external CLI data sharing, and an unrelated autonomous GitHub push. Provenance appears same-org rather than clearly malicious, so this is not confirmed malware, but the overall footprint is broader and riskier than the stated purpose alone.