orchestration
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to resolve and run local executables, including
orca,orca-ide, or a command specified in theORCA_CLI_COMMANDenvironment variable. - [INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to fetch its primary logic at runtime using
ORCA skills get orchestration. This creates a dependency on the output of a local shell command to define subsequent agent behavior and task coordination. - Ingestion points: The output of the
ORCA skills get orchestrationcommand (SKILL.md). - Boundary markers: None identified in the provided stub.
- Capability inventory: The skill description grants the agent capabilities for shell commands, terminal control, and worktree management (SKILL.md).
- Sanitization: No specific sanitization or validation of the fetched instructions is described.
- [DYNAMIC_EXECUTION]: The agent is instructed to "load the version-matched guide" before running further commands, which involves executing a tool to generate instructions that the agent must then interpret and follow during the session.
Audit Metadata