The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to "re-run it with escalated permissions" if it encounters a runtime_access_denied error from the CLI tool. This encourages the agent to bypass security constraints or execute commands with administrative privileges (e.g., using sudo or runas).
[DYNAMIC_EXECUTION]: The skill uses ORCA skills get orca-ledger to load a "version-matched guide" at runtime. This pattern means the actual operational logic and detailed instructions followed by the agent are fetched dynamically from the executable and are not subject to static analysis of the skill file.
[COMMAND_EXECUTION]: The skill provides logic to resolve a local binary (orca, orca-ide, or orca-dev) based on environment variables like ORCA_CLI_COMMAND and ORCA_DEV_REPO_ROOT. It then executes these binaries with various flags, which could lead to unexpected command execution if environment variables are manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill processes engineering observations (bugs, proposals, decisions) stored in a "ledger". These entries are external data that may contain malicious instructions targeting the agent.
Ingestion points: Operations such as orca ledger review, orca ledger show, and orca ledger import bring external ledger content into the agent's context.
Boundary markers: No explicit delimiters or instruction-ignore warnings are specified for the ingested content.
Capability inventory: The skill has the ability to execute shell commands and modify local files via the Orca CLI.
Sanitization: No sanitization or validation of the fetched ledger content is mentioned.

orca-ledger