orca-harness
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the orca CLI, gh (GitHub CLI), jq, and rg (ripgrep) to manage orchestration, PRs, and search tasks.\n- [PERSISTENCE]: The skill provides mappings for Cursor's heartbeat features to orca automations create, enabling the setup of scheduled recurring tasks (e.g., hourly triggers) within the Orca environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external configuration files and transcripts, creating a surface for potential indirect prompt injection.\n
- Ingestion points: Reads from ~/.agents/pstack-models.md, $ORCA_USER_DATA_PATH/agent-model-catalog.json, and session transcripts located in agent-specific directories (e.g., ~/.claude/projects/, ~/.codex/sessions/).\n
- Boundary markers: No explicit instructions are provided to the agent to use delimiters or to treat the content of these files as untrusted.\n
- Capability inventory: The agent can execute arbitrary shell commands via orca terminal create, spawn workers with orca orchestration worker-start, and modify files.\n
- Sanitization: There are no instructions to sanitize or validate the content retrieved from these external files before processing.
Audit Metadata