orca-dispatch-reference
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPERSISTENCEDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for executing various CLI tools including
orca,opencode,agy(Antigravity), andgit. These commands are used for task dispatching, worktree management, and synchronization of artifacts. - [EXTERNAL_DOWNLOADS]: The skill interacts with an external API at
https://agentmemory.giatbh.io.vnto store and retrieve data. It also performsgit cloneoperations from the vendor repositorygithub.com/rheinmir/setup.gitto synchronize skill files. - [DATA_EXFILTRATION]: Instructions include sending data (labeled as "memories") to an external service (
agentmemory.giatbh.io.vn) usingcurl. The use of the-k(--insecure) flag in these commands bypasses SSL certificate validation, which is a poor security practice. - [PERSISTENCE]: The skill documents how to persistently modify the agent's behavior by installing new skills into specific directories (
.claude/commands/,~/.agents/skills/) and installingrtk(Rust Token Killer) hooks that intercept and modify agent commands. - [DYNAMIC_EXECUTION]: The orchestration workflow involves dispatching arbitrary task strings to other agent binaries (e.g.,
opencode run,orca terminal send), which results in the dynamic execution of instructions in separate processes or worktrees.
Audit Metadata