orca-orchestration
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a multi-session orchestration pattern where a central "conductor" session ingests and acts upon data generated by external "worker" sessions.
- Ingestion points: Worker reports (e.g.,
.session/orchestration/<slug>/reports/<label>.md) and mailbox messages (retrieved viaorca orchestration check) are read into the conductor's context. - Boundary markers: The instructions provide specific file naming conventions and path structures but do not mandate the use of strict delimiters to isolate worker-provided content from agent instructions.
- Capability inventory: The conductor session executes powerful system commands, including
orcaCLI operations for terminal management,git worktreecreation/deletion, andterminal sendfor remote command execution in other sessions. - Sanitization: The instructions do not specify sanitization or validation routines for data received from workers before it influences the conductor's next actions.
- [EXTERNAL_DOWNLOADS]: The skill documentation describes procedures for installing external command grammars (stubs) using the
orca skills installcommand. These resources are retrieved from the vendor's infrastructure to provide the latest command definitions for the orchestration runtime. - [COMMAND_EXECUTION]: The orchestration workflow relies on frequent execution of the
orcaCLI to manage terminals, tasks, and dispatches. Notably, the conductor usesterminal sendto inject instructions and commands directly into the input streams of worker sessions, which is the intended primary functionality of the tool.
Audit Metadata