orca-workflow

SUSPICIOUS. The core dispatch/orchestration behavior is plausible, but the skill exceeds that purpose by forwarding session memory and a bearer token to a third-party service with TLS verification disabled, and by instructing transitive installation into other agent runtimes. Combined with external git push behavior and questionable Orca provenance/syntax alignment, the data flows and trust boundaries are broader than necessary for a workflow skill.