{"data":{"skill":{"slug":"phucd-orca-cli","name":"orca-cli","icon":"📦","repo":"https://github.com/phucd/orca/tree/25f87544d0b7dc118d5258fdc4c670692fc371d5/skills/orca-cli","status":"approved","author":"phucd","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"7f325e07-4584-4315-a9cb-6bd94115c22c","skill_id":"6c7ffbaf-8c85-497b-a485-1916f97f46e0","version":1,"content_hash":"v3:eeb54b046a79c9cbd918e2b110c5d6b2b95b0728:aa76f86505010096e8ea9edda1705a78aae7af45e54485f3fe0460664c1d9e4a:063eb7e73b668c4b8b92853d38e9fda92888945bcea8563fefe567dc93169742:736b696c6c732f70687563642f6f7263612d636c69:be02d1a67530b4ff47be68784c0d08a6","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 18 static findings are false positives: Markdown backticks and shell names do not demonstrate Ruby or shell execution. Semantic concerns involve loading an unreviewed runtime guide and recommending permission escalation without an explicit approval condition. No evidence found of credential theft, data exfiltration, or instructions targeting the security audit.","remediation":[{"issue":"The runtime guide is outside the reviewed skill and becomes additional operating instructions.","severity":"medium","suggestion":"Document the guide trust boundary, verify the selected executable and guide provenance, and review loaded instructions before allowing state-changing actions."},{"issue":"Sandbox denial triggers an escalation recommendation without checking user authorization or permission policy.","severity":"high","suggestion":"Require explicit user approval and host-policy support before escalation; otherwise report the denial and stop."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":5,"line_start":5},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":40,"line_start":38},{"file":"SKILL.md","line_end":42,"line_start":40},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":44,"line_start":43},{"file":"SKILL.md","line_end":45,"line_start":44},{"file":"SKILL.md","line_end":46,"line_start":45},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":31,"line_start":31}]}],"critical_findings":[],"high_findings":[{"title":"Permission Escalation Without an Approval Condition","locations":[{"file":"SKILL.md","line_end":45,"line_start":44}],"confidence":0.93,"description":"The instruction 're-run it with escalated permissions' follows a sandbox denial without an explicit authorization check. Following it could move operations outside intended sandbox restrictions.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The text directly recommends escalation after sandbox denial and contains no approval condition. Host permission controls may prevent escalation, so actual bypass is not demonstrated."}],"medium_findings":[{"title":"Runtime Guide Extends the Audited Instruction Boundary","locations":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":42,"line_start":36}],"confidence":0.85,"description":"The stub loads a version-matched guide from the selected executable before further operations. That guide is not bundled or validated here and could supply unsafe instructions if its source is compromised.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The file explicitly delegates further guidance to runtime output without specifying provenance validation. No evidence found that the executable or guide is malicious."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":48,"audit_model":"codex","audited_at":"2026-10-12T17:15:38.127+00:00","created_at":"2026-10-13T16:46:22.083144+00:00","static_findings":[{"id":"external_commands:SKILL.md:5:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"skill sharing, worktree comments, and Orca's embedded browser through the `orca` CLI. Use","category":"external_commands","line_end":5,"severity":"medium","line_start":5},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If the `ORCA_CLI_COMMAND` environment variable is set, use its value. Orca exports this","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Otherwise, in a dev checkout whose session exposes `ORCA_DEV_REPO_ROOT`, use `orca-dev`.","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Otherwise, on Linux outside an Orca-managed terminal, use `orca-ide`. Never run bare","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`orca` there — outside Orca's terminals it normally resolves to the","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"GNOME Orca screen reader (`/usr/bin/orca`) and starts speech on the user's machine.","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Otherwise, use `orca`.","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Below, `ORCA` is a placeholder for the executable you resolved. Substitute it before","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"running anything; do not create a shell variable or run `ORCA` literally. This works the","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```text","category":"external_commands","line_end":40,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":42,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Prefer `--json`. Use the selected executable's `--help` for commands or flags the guide does","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"not cover. If a command reports that Orca is not running, start it with `ORCA open --json`","category":"external_commands","line_end":44,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"and retry. If it fails with `runtime_access_denied`, your sandbox blocked the connection:","category":"external_commands","line_end":45,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"re-run it with escalated permissions, and do not run `ORCA open` or restart Orca. If","category":"external_commands","line_end":46,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`skills get` is unknown, explain that updating Orca restores the guide; use `--help` for","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:31:powershell-invocation","file":"SKILL.md","pattern":"PowerShell invocation","snippet":"same way in POSIX shells, PowerShell, and cmd.exe.","category":"external_commands","line_end":31,"severity":"high","line_start":31},{"id":"external_commands:SKILL.md:31:windows-cmd-exe","file":"SKILL.md","pattern":"Windows cmd.exe","snippet":"same way in POSIX shells, PowerShell, and cmd.exe.","category":"external_commands","line_end":31,"severity":"high","line_start":31}],"finding_verdicts":[{"id":"external_commands:SKILL.md:5:ruby-shell-backtick-execution","reason":"The backticks format the CLI name in a YAML description. The complete file contains documentation, not Ruby or shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The backticks mark an environment-variable name in Markdown. Executable selection is prose, not backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"Markdown backticks format the development environment variable and executable name. No Ruby expression or shell substitution appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The inline code span identifies the Linux executable. The text describes CLI selection and does not execute backtick content.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The formatted executable name occurs in a warning against launching the wrong application. It is Markdown, not command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticks format the screen reader executable path in an explanatory warning. No instruction executes that path.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"The inline code span names the fallback CLI in Markdown prose. This is not Ruby or shell backtick syntax in executable code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"The formatted token is explicitly identified as an executable placeholder. No shell substitution or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The backticks format a placeholder that the text explicitly says not to run literally. They are not execution operators.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"This is the opening Markdown text fence around the guide-retrieval example. The fence does not perform Ruby or shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"This is the closing Markdown code fence followed by formatted CLI flags. Neither is a backtick execution construct.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The inline code spans format JSON and help flags for ordinary CLI discovery. There is no command substitution or dynamic Ruby evaluation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The backticks format a documented application-start command, not shell substitution. Starting Orca is a stated workflow action, not evidence of backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The backticks format an error identifier in Markdown. The adjacent escalation guidance is assessed separately as a semantic concern.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The inline command is formatted Markdown and is explicitly discouraged in this error case. The permission recommendation is not backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"Markdown spans identify a subcommand and the help flag. The fallback restricts discovery to read-only operations and does not use shell substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:31:powershell-invocation","reason":"PowerShell is mentioned only as a compatible shell. There is no PowerShell invocation, command payload, or encoded script.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:31:windows-cmd-exe","reason":"cmd.exe appears only in a shell-compatibility sentence. No Windows command interpreter is launched.","verdict":"false_positive","confidence":1}],"semantic_findings":[{"title":"Runtime Guide Extends the Audited Instruction Boundary","severity":"medium","locations":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":42,"line_start":36}],"confidence":0.85,"description":"The stub loads a version-matched guide from the selected executable before further operations. That guide is not bundled or validated here and could supply unsafe instructions if its source is compromised.","confidence_reasoning":"The file explicitly delegates further guidance to runtime output without specifying provenance validation. No evidence found that the executable or guide is malicious."},{"title":"Permission Escalation Without an Approval Condition","severity":"high","locations":[{"file":"SKILL.md","line_end":45,"line_start":44}],"confidence":0.93,"description":"The instruction 're-run it with escalated permissions' follows a sandbox denial without an explicit authorization check. Following it could move operations outside intended sandbox restrictions.","confidence_reasoning":"The text directly recommends escalation after sandbox denial and contains no approval condition. Host permission controls may prevent escalation, so actual bypass is not demonstrated."}],"subject_marketplace_commit_sha":"eeb54b046a79c9cbd918e2b110c5d6b2b95b0728","subject_content_hash":"aa76f86505010096e8ea9edda1705a78aae7af45e54485f3fe0460664c1d9e4a","subject_tree_hash":"063eb7e73b668c4b8b92853d38e9fda92888945bcea8563fefe567dc93169742","subject_plugin_path":"skills/phucd/orca-cli","audit_payload_hash":"be02d1a67530b4ff47be68784c0d08a6","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"eeb54b046a79c9cbd918e2b110c5d6b2b95b0728","contentHash":"aa76f86505010096e8ea9edda1705a78aae7af45e54485f3fe0460664c1d9e4a","treeHash":"063eb7e73b668c4b8b92853d38e9fda92888945bcea8563fefe567dc93169742","pluginPath":"skills/phucd/orca-cli","auditPayloadHash":"be02d1a67530b4ff47be68784c0d08a6"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/phucd-orca-cli/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}