The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The instructions explicitly tell the agent that if a command fails with a runtime_access_denied error, it should "re-run it with escalated permissions." This encourages bypassing security boundaries by seeking administrative or root-level access to the system.
[EXTERNAL_DOWNLOADS]: The skill uses the command ORCA skills get orca-emulator to fetch dynamic content (described as a "version-matched guide") from an external source at runtime. This introduces external data into the agent's processing stream that is not present in the skill package itself.
[COMMAND_EXECUTION]: The skill defines logic to resolve a local binary path based on environment variables (ORCA_CLI_COMMAND, ORCA_DEV_REPO_ROOT) and the operating system environment, then executes various subcommands like skills get and open.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon instructions provided by the output of the ORCA skills get command. This creates an attack surface where a compromised or malicious tool could inject instructions directly into the agent's context.
Ingestion points: The output of the ORCA skills get command referenced in SKILL.md.
Boundary markers: There are no delimiters or explicit instructions to treat the fetched content as untrusted data.
Capability inventory: The skill possesses the capability to execute shell commands and resolve local file paths.
Sanitization: There is no evidence of sanitization, validation, or filtering of the fetched guide content before the agent is instructed to use it.

orca-emulator