orca-workflow

SUSPICIOUS: the core Orca orchestration purpose is mostly coherent, but the skill’s footprint is broader than necessary. The main concerns are third-party memory exfiltration to agentmemory.giatbh.io.vn using curl -k, transitive installation of skills into other agent runtimes, credential/token forwarding to external services, and autonomous external actions including GitHub issue creation and repo pushes. Official CLI provenance lowers malware confidence, but the overall skill remains high-risk from data-flow and trust expansion.