orca-dispatch-reference

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPERSISTENCEDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for executing various CLI tools including orca, opencode, agy (Antigravity), and git. These commands are used for task dispatching, worktree management, and synchronization of artifacts.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with an external API at https://agentmemory.giatbh.io.vn to store and retrieve data. It also performs git clone operations from the vendor repository github.com/rheinmir/setup.git to synchronize skill files.
  • [DATA_EXFILTRATION]: Instructions include sending data (labeled as "memories") to an external service (agentmemory.giatbh.io.vn) using curl. The use of the -k (--insecure) flag in these commands bypasses SSL certificate validation, which is a poor security practice.
  • [PERSISTENCE]: The skill documents how to persistently modify the agent's behavior by installing new skills into specific directories (.claude/commands/, ~/.agents/skills/) and installing rtk (Rust Token Killer) hooks that intercept and modify agent commands.
  • [DYNAMIC_EXECUTION]: The orchestration workflow involves dispatching arbitrary task strings to other agent binaries (e.g., opencode run, orca terminal send), which results in the dynamic execution of instructions in separate processes or worktrees.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 02:24 AM