orchestration
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to interact with a local orchestration CLI. It instructs the agent to resolve a binary (prioritizing
ORCA_CLI_COMMAND, thenorca-devororca-ide) and execute subcommands likestatus,open, andorchestration task-list. - [DYNAMIC_EXECUTION]: The skill uses runtime environment detection to determine which executable to use. It resolves the
ORCAplaceholder based on environment variables (ORCA_CLI_COMMAND,ORCA_DEV_REPO_ROOT) and the operating system, which is intended for cross-environment compatibility. - [INDIRECT_PROMPT_INJECTION]: The skill implements a dynamic loading mechanism where the primary usage instructions are fetched at runtime via the command
ORCA skills get orchestration. This creates an ingestion point for agent instructions from the local binary's output, ensuring version synchronization with the installed tool.
Audit Metadata