orca-emulator-android
Warn
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: MEDIUMPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The instructions explicitly direct the agent to re-run commands with "escalated permissions" if a 'runtime_access_denied' error is encountered. This encourages the agent to seek administrative access (e.g., via sudo), which significantly increases the risk to the host system.
- Evidence: "If it fails with runtime_access_denied, your sandbox blocked the connection: re-run it with escalated permissions"
- [INDIRECT_PROMPT_INJECTION]: The skill dynamically loads its main instructional content through the output of an external command ('ORCA skills get orca-emulator-android'). This creates a vulnerability where the tool's output could inject malicious instructions into the agent's context.
- Ingestion points: The content of the 'ORCA skills get' command is used as the operational guide.
- Boundary markers: There are no instructions or delimiters provided to ensure the agent ignores potentially adversarial content within the loaded guide.
- Capability inventory: The skill has broad capabilities including booting emulators, installing apps, and managing system permissions via adb.
- Sanitization: There is no evidence of output validation or sanitization.
- [COMMAND_EXECUTION]: The skill performs command execution using binaries that are determined at runtime based on environment variables or OS context. While intended for tool resolution, this dynamic pathing can be a target for redirection.
- Evidence: The resolution logic checks 'ORCA_CLI_COMMAND', 'ORCA_DEV_REPO_ROOT', and Linux-specific pathing to identify the 'orca' binary.
Audit Metadata