computer-use
Warn
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill fetches its actual operational instructions at runtime by executing
ORCA skills get computer-use. This behavior prevents static security analysis of the instructions the agent will ultimately follow.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the UI of third-party applications (e.g., Spotify, Slack).\n - Ingestion points: Accessibility trees, screenshots, and visible UI text from local desktop apps as specified in the description and trigger list.\n
- Boundary markers: Absent. The instructions do not provide delimiters to separate application content from the agent's internal instructions.\n
- Capability inventory: The skill allows the agent to click, type, drag, press keys, and perform accessibility actions across the desktop environment.\n
- Sanitization: Absent. External UI content is not sanitized or filtered before being processed by the agent.\n- [COMMAND_EXECUTION]: The skill executes local binaries (
orca,orca-ide, ororca-dev) to perform desktop operations. It resolves the executable path dynamically based on environment variables likeORCA_CLI_COMMAND, which could be redirected to an unauthorized binary in a compromised environment.
Audit Metadata