orca-orchestration

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a multi-session orchestration pattern where a central "conductor" session ingests and acts upon data generated by external "worker" sessions.
  • Ingestion points: Worker reports (e.g., .session/orchestration/<slug>/reports/<label>.md) and mailbox messages (retrieved via orca orchestration check) are read into the conductor's context.
  • Boundary markers: The instructions provide specific file naming conventions and path structures but do not mandate the use of strict delimiters to isolate worker-provided content from agent instructions.
  • Capability inventory: The conductor session executes powerful system commands, including orca CLI operations for terminal management, git worktree creation/deletion, and terminal send for remote command execution in other sessions.
  • Sanitization: The instructions do not specify sanitization or validation routines for data received from workers before it influences the conductor's next actions.
  • [EXTERNAL_DOWNLOADS]: The skill documentation describes procedures for installing external command grammars (stubs) using the orca skills install command. These resources are retrieved from the vendor's infrastructure to provide the latest command definitions for the orchestration runtime.
  • [COMMAND_EXECUTION]: The orchestration workflow relies on frequent execution of the orca CLI to manage terminals, tasks, and dispatches. Notably, the conductor uses terminal send to inject instructions and commands directly into the input streams of worker sessions, which is the intended primary functionality of the tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 06:31 PM