orca-graph
Fail
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions for the agent to install its core engine by downloading and executing a shell script directly from the author's GitHub repository via a pipe to shell (e.g.,
curl -fsSL https://raw.githubusercontent.com/Rheinmir/orca-graph/main/install.sh | bash). - [COMMAND_EXECUTION]: The skill executes arbitrary shell commands provided in user-defined
PLAN.mdfiles through itsrun,verify, andQCfunctions, allowing for the execution of subprocesses based on untrusted data. - [PERSISTENCE]: The skill mentions a background daemon process (
watch) intended to monitor task execution and manage leases, which can maintain code execution across sessions. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted instructions from
PLAN.mdfiles which are used to control execution flow and define shell commands. - Ingestion points: Processes
PLAN.mdfiles to extract task metadata, dependencies, and execution scripts. - Boundary markers: Uses specific markdown headers and key-value pairs (e.g.,
**Depends:**,**Verify:**) to identify and isolate task properties. - Capability inventory: Possesses capabilities to execute shell commands, monitor system processes, and perform file system operations within the specified store directory.
- Sanitization: Implements an optional
--strictmode that monitors for unauthorized file changes during task execution using Git diffs and attempts to revert them if they were not declared in the task specification.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/Rheinmir/orca-graph/main/install.sh - DO NOT USE without thorough review
Audit Metadata