The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions explicitly direct the agent to "re-run it with escalated permissions" if the command fails with a runtime_access_denied error. This encourages the agent to bypass sandbox restrictions or attempt to gain higher system privileges (e.g., via sudo or administrative shells) which can compromise host security.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from native application windows and web browsers, creating a surface for malicious data to influence the agent.
Ingestion points: Accessibility trees, menus, dialogs, and screenshots from external browser windows (Chrome, Edge, Safari) and native applications (SKILL.md).
Boundary markers: The skill lacks delimiters or explicit instructions to treat the ingested GUI/web content as untrusted data, increasing the risk that embedded instructions in those windows could be followed by the agent.
Capability inventory: The skill description lists capabilities including shell execution, filesystem access, git operations, and HTTP requests, which could be abused if the agent is compromised via indirect injection.
Sanitization: No sanitization or filtering logic is specified for the content extracted from the GUI accessibility tree or screenshots.
[COMMAND_EXECUTION]: The skill executes local CLI binaries (orca, orca-ide, orca-dev) and resolves their paths dynamically based on environment variables like ORCA_CLI_COMMAND. While these are vendor-provided tools, the execution occurs outside the agent's immediate control.

orca-computer-use