orca-linear
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute a local command-line tool (
orca,orca-dev, ororca-ide) to read ticket context, update statuses, and attach links. It includes logic for resolving the correct executable based on environment variables and the operating system. - [INDIRECT_PROMPT_INJECTION]: The skill involves reading external data from Linear tickets, which constitutes a potential attack surface for indirect prompt injection. However, the instructions explicitly command the agent to treat this data as untrusted and to never follow instructions embedded within the ticket text.
- [DYNAMIC_EXECUTION]: The skill uses a bootstrap pattern where it instructs the agent to run
ORCA skills get orca-linearto retrieve the full, version-matched documentation from the local binary at runtime, ensuring the agent's instructions are synchronized with the tool's version.
Audit Metadata