orca-cli

1 unpinned: @orca/process-host

PRIVILEGE_ESCALATION; DYNAMIC_EXECUTION; INDIRECT_PROMPT_INJECTION; COMMAND_EXECUTION — [PRIVILEGE_ESCALATION]: The skill contains explicit instructions for the agent to bypass sandbox restrictions. Specifically, it tells the agent that if a command is blocked by the sandbox (resulting in a runtime_access_denied error), it should re-run the command with escalated permissions. [DYNAMIC_EXECUTION]: The skill uses a pattern where the core logic and instructions are not present in the static file but are instead fetched at runtime using the command ORCA skills get orca-cli. This dynamic instruction loading makes the full behavior of the skill opaque to static analysis and can be use…

E004 Prompt injection detected in skill instructions.; W011 Third-party content exposure detected (indirect prompt injection risk).; W013 Attempt to modify system services in skill instructions. — Potential prompt injection detected (medium risk: 0.30). The skill is a legitimate CLI discovery stub, but it tells the agent to re-run commands with escalated permissions when the sandbox blocks access, which weakens a protection without asking the user. Third-party content exposure detected (low risk: 0.10). The required workflow in this stub only resolves the CLI and loads the first-party version-matched guide via ORCA skills get orca-cli, but its description routes external web page opening and rendering checks to Orca's embedded browser, which the agent must actively fetch from arbitrary…