orca-cli
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed as a 'discovery stub' that directs the agent to load its primary instructions from the output of an external command (
ORCA skills get orca-cli). This creates a vulnerability surface where the agent's behavior is governed by dynamically ingested content from a local process. - Ingestion points: The agent is instructed to run
ORCA skills get orca-cliand follow the guide it prints (SKILL.md). - Boundary markers: None are present to delimit the dynamic instructions or warn the agent to ignore potentially malicious overrides in the output.
- Capability inventory: The agent is granted the ability to execute shell commands via the resolved Orca binary, manage worktrees, interact with terminals, and control an embedded browser (SKILL.md).
- Sanitization: There is no validation or sanitization of the content returned by the CLI before it is adopted as the session's instruction set.
- [COMMAND_EXECUTION]: The skill's primary purpose is to execute system commands using various Orca-related binaries (
orca,orca-ide,orca-dev). While this is the intended functionality, it provides the agent with a broad command surface including worktree management and terminal interaction.
Audit Metadata