The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions in SKILL.md explicitly direct the agent to "re-run it with escalated permissions" if it encounters a runtime_access_denied error. This instruction encourages the agent to bypass system or sandbox security constraints.
[COMMAND_EXECUTION]: The skill resolves its primary executable based on the ORCA_CLI_COMMAND environment variable or local binary names like orca-dev and orca-ide. This allows the agent to execute external system commands and potentially allows command injection if the environment variable is manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill ingests instructions at runtime from the output of the command ORCA skills get computer-use.
Ingestion points: The agent is instructed to load a "version-matched guide" from the CLI tool's output as seen in SKILL.md.
Boundary markers: There are no boundary markers or instructions provided to treat the dynamically loaded guide as untrusted data or to ignore embedded instructions.
Capability inventory: The skill possesses broad capabilities including GUI manipulation (clicking, typing), shell execution, and filesystem access.
Sanitization: The skill lacks any mechanism to sanitize or validate the content returned by the external tool before processing it as instructions.
[DATA_EXFILTRATION]: The skill probes the host environment for specific variables like ORCA_CLI_COMMAND and ORCA_DEV_REPO_ROOT to determine its execution path, which involves exposing local environment state to the agent's context.

computer-use