The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill's instructions explicitly tell the agent to "re-run it with escalated permissions" if its connection is blocked by a sandbox (identified by a runtime_access_denied error). This encourages the agent to seek higher system privileges to bypass established security boundaries.
[INDIRECT_PROMPT_INJECTION]: The skill implements a mechanism to load instructions at runtime from an external source.
Ingestion points: The agent is instructed to run ORCA skills get orca-cli to load a "version-matched guide" which then dictates subsequent actions.
Boundary markers: The skill provides no delimiters or instructions for the agent to ignore potentially malicious or contradictory commands contained within the fetched guide.
Capability inventory: The agent has the capability to execute shell commands and interact with the local filesystem through the resolved orca executable.
Sanitization: There is no evidence of validation or sanitization of the content returned by the CLI before it is processed as instructions by the agent.
[COMMAND_EXECUTION]: The skill uses dynamic logic to resolve which binary to execute (orca, orca-dev, or orca-ide) based on environment variables like ORCA_CLI_COMMAND or local repository states. This allows for the execution of different binaries depending on the environment, which could be manipulated to point to malicious executables.

orca-cli