orca-workflow
Warn
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill transmits session context, including facts, decisions, and preferences, to an unverified external memory service at
https://agentmemory.giatbh.io.vn/.\n - Evidence: Uses
curlto POST JSON data to the/agentmemory/rememberendpoint.\n - Evidence: Communication with this service uses the
-k(or--insecure) flag, which bypasses SSL certificate verification and exposes transmitted data to man-in-the-middle attacks.\n- [DATA_EXFILTRATION]: The skill includes instructions to synchronize local modifications to the author's remote Git repository.\n - Evidence: Automated commands to clone, update, and push skill files to
git@github.com:rheinmir/setup.git.\n- [DYNAMIC_EXECUTION]: The skill automates the installation of other executable skills into various local CLI agent environments.\n - Evidence: Copies markdown files containing executable instructions into directories such as
~/.claude/commands/,~/.agents/skills/, and~/.kiro/skills/.\n- [COMMAND_EXECUTION]: The workflow relies on executing several local shell and Python utility scripts that interact with the system and other developer tools.\n - Evidence: Execution of
harness/poc-vendor-neutral/bin/pull-gate-sweep.shand Python scripts such ascode-logger.pyandorca-reconcile.py.\n - Evidence: Direct interaction with
docker inspectto monitor container volume mounts.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection by processing external data from a wiki to generate execution plans without explicit sanitization.\n - Ingestion points: Reads from local
llmwiki/files and external memory service search results.\n - Boundary markers: Lacks explicit delimiters or warnings to ignore instructions embedded within the ingested data.\n
- Capability inventory: Capable of shell script execution, persistent file modification, and network operations.\n
- Sanitization: No visible protocols for validating or filtering content retrieved from external sources before use in the workflow.
Audit Metadata