mo-orchestrate-orca
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes external command-line tools including
git,gh(GitHub CLI),glab(GitLab CLI), and theorca-clibackend to perform repository management, issue routing, and feature orchestration. - [DYNAMIC_EXECUTION]: The bundled
mo-posture.shscript dynamically executes diagnostic probes withinbashandzshenvironments to detect shadowed builtins or malicious aliases. The Orca mechanics also support launching terminal sessions with harness-specific commands. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources such as GitHub/GitLab issue descriptions and user-provided intent ledgers. It mitigates these risks through a mandatory redaction protocol that identifies and masks sensitive information (tokens, passwords, private keys) before commits are made.
- [SAFE]: No malicious patterns were detected. The skill includes defensive measures such as privileged mode shell execution, strict temporary file permissions (
umask 077), and comprehensive logging of automated decisions.
Audit Metadata