orca-orchestration
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a conductor-worker architecture where a primary agent processes data from sub-agents. * Ingestion points: The conductor agent reads worker reports from .session/orchestration/slug/reports/ and processes status updates via the orca orchestration check command. * Boundary markers: The skill instructs workers to format reports using Markdown headers to delimit sections. * Capability inventory: The conductor maintains capabilities to execute shell commands through orca, git, and bun. * Sanitization: The skill enforces strict file ownership and absolute path usage to constrain worker activity and prevent unauthorized directory traversal.
- [DYNAMIC_EXECUTION]: The skill dynamically generates prompt payloads for orchestration tasks. * Evidence: The conductor uses the orca orchestration task-create command with a dynamically generated --spec string that defines the initial operational context and instructions for worker sessions.
- [COMMAND_EXECUTION]: The orchestration process relies on the execution of local system commands to manage the lifecycle of agent sessions. * Evidence: The skill utilizes orca worktree create, git rev-parse, and bun run worktree:provision to manage environment state and project isolation.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of dependencies during environment setup. * Evidence: The provisioning logic within the worktree setup hook executes bun install --frozen-lockfile to restore project dependencies in newly created agent environments.
Audit Metadata