orca-orchestration

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a conductor-worker architecture where a primary agent processes data from sub-agents. * Ingestion points: The conductor agent reads worker reports from .session/orchestration/slug/reports/ and processes status updates via the orca orchestration check command. * Boundary markers: The skill instructs workers to format reports using Markdown headers to delimit sections. * Capability inventory: The conductor maintains capabilities to execute shell commands through orca, git, and bun. * Sanitization: The skill enforces strict file ownership and absolute path usage to constrain worker activity and prevent unauthorized directory traversal.
  • [DYNAMIC_EXECUTION]: The skill dynamically generates prompt payloads for orchestration tasks. * Evidence: The conductor uses the orca orchestration task-create command with a dynamically generated --spec string that defines the initial operational context and instructions for worker sessions.
  • [COMMAND_EXECUTION]: The orchestration process relies on the execution of local system commands to manage the lifecycle of agent sessions. * Evidence: The skill utilizes orca worktree create, git rev-parse, and bun run worktree:provision to manage environment state and project isolation.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of dependencies during environment setup. * Evidence: The provisioning logic within the worktree setup hook executes bun install --frozen-lockfile to restore project dependencies in newly created agent environments.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 05:41 PM
Security Audit — agent-trust-hub — orca-orchestration