Fähigkeiten orca-cli
📦

orca-cli

Inhaltsrevision r1 Hohes Risiko ⚙️ Externe Befehle

Load the Correct Orca CLI Guide

Different Orca sessions can require different executables and command guides. This skill resolves the session executable and retrieves version-matched guidance before further operations.

Unterstützt: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 Schlecht

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage
Review the Skillstore skill "orca-cli" from https://skillstore.io/skills/phucd-orca-cli.md and its manifest at https://skillstore.io/api/skills/phucd-orca-cli/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/phucd-orca-cli.md Signiertes manifest GET /api/skills/phucd-orca-cli/manifest Signiertes lockfile GET /api/skills/phucd-orca-cli/lockfile

Testen

„orca-cli“ wird verwendet. Which executable should I use on Linux outside an Orca-managed terminal, with no session override or development marker?

Erwartetes Ergebnis:

Use orca-ide. Avoid bare orca because it can launch the GNOME screen reader.

„orca-cli“ wird verwendet. The selected Orca executable cannot run. Should I try another executable?

Erwartetes Ergebnis:

Report the exact error and stop. Switching executables could target a different Orca build.

„orca-cli“ wird verwendet. The installed CLI does not recognize the guide retrieval command. What comes next?

Erwartetes Ergebnis:

Updating Orca restores the guide according to the skill. Until then, use help for read-only discovery and avoid guessing unsupported commands.

Sicherheitsaudit

Hohes Risiko
v1 • 12.10.2026 Versionsbericht öffnen

All 18 static findings are false positives: Markdown backticks and shell names do not demonstrate Ruby or shell execution. Semantic concerns involve loading an unreviewed runtime guide and recommending permission escalation without an explicit approval condition. No evidence found of credential theft, data exfiltration, or instructions targeting the security audit.

1
Gescannte Dateien
48
Analysierte Zeilen
0
Prüfelemente
0
Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Hoch
SKILL.md:44-45
Permission Escalation Without an Approval Condition
The instruction 're-run it with escalated permissions' follows a sandbox denial without an explicit authorization check. Following it could move operations outside intended sandbox restrictions.
The text directly recommends escalation after sandbox denial and contains no approval condition. Host permission controls may prevent escalation, so actual bypass is not demonstrated.
Mittel
SKILL.md:15SKILL.md:36-42
Runtime Guide Extends the Audited Instruction Boundary
The stub loads a version-matched guide from the selected executable before further operations. That guide is not bundled or validated here and could supply unsafe instructions if its source is compromised.
The file explicitly delegates further guidance to runtime output without specifying provenance validation. No evidence found that the executable or guide is malicious.

Risikofaktoren

⚙️ Externe Befehle (18)
SKILL.md:5 SKILL.md:21 SKILL.md:23 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:29 SKILL.md:30 SKILL.md:38-40 SKILL.md:40-42 SKILL.md:42 SKILL.md:43-44 SKILL.md:44-45 SKILL.md:45-46 SKILL.md:46 SKILL.md:31 SKILL.md:31
Geprüft von: codex
Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen
Sicherheitsbewertung

Berichtslink kopieren

https://skillstore.io/skills/phucd-orca-cli/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/phucd-orca-cli/security.svg)](https://skillstore.io/skills/phucd-orca-cli?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/phucd-orca-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/phucd-orca-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/phucd-orca-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

phucd. (2026). orca-cli security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/phucd-orca-cli/audits/1

BibTeX-Zitat

@techreport{phucd-phucd-orca-cli-2026, author = {phucd}, title = {orca-cli security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/phucd-orca-cli/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "orca-cli security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "phucd" date-released: "2026-10-12" url: "https://skillstore.io/skills/phucd-orca-cli/audits/1" identifiers: - type: other value: "skillstore:phucd-orca-cli:audit:1" description: "Skillstore immutable audit report identifier"

Varianten vergleichen

6 installierbare Varianten

Jeder Autor bleibt ein eigener installierbarer Skill. Die empfohlene Variante wird nach Skillstore-Nachweisen bewertet.

Warum diese Variante zuerst steht

Höchster Skillstore-Score
vjk7989 Empfohlen

vjk7989-orca-cli

Skillstore-Score 78
Evidenzvertrauen Mittel
Skillstore-Nutzung 8
Aktualisiert

2026-09-09

agc2020

agc2020-orca-cli

Skillstore-Score 70
Evidenzvertrauen Mittel
Skillstore-Nutzung 6
Aktualisiert

2026-10-16

kerenski

kerenski-orca-cli

Skillstore-Score 69
Evidenzvertrauen Mittel
Skillstore-Nutzung 22
Aktualisiert

2026-09-09

zpyoung

zpyoung-orca-cli

Skillstore-Score 69
Evidenzvertrauen Mittel
Skillstore-Nutzung 6
Aktualisiert

2026-10-11

stablyai

stablyai-orca-cli

Skillstore-Score 38
Evidenzvertrauen Mittel
Skillstore-Nutzung 12
Aktualisiert

2026-09-09

phucd Aktuell

phucd-orca-cli

Skillstore-Score 38
Evidenzvertrauen Mittel
Skillstore-Nutzung 5
Aktualisiert

2026-10-16

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel
55
Architektur
85
Wartbarkeit
87
Inhalt
65
Gemeinschaft
83
Spezifikationskonformität

Was Sie erstellen können

Prepare a Worktree Session

Resolve the correct Orca executable and retrieve its guide before planning a child worktree.

Prepare an Agent Handoff

Load session-matched guidance before coordinating terminals and transferring work between agents.

Discover Browser Workflow Commands

Consult the installed guide and help output before using Orca browser features for application checks.

Diese Prompts ausprobieren

Identify the Session Executable 
Use orca-cli to identify the executable for this session. Explain the selection without starting Orca or changing state.
Retrieve the Matching Guide 
Resolve the trusted Orca executable and retrieve its orca-cli guide. Summarize available read-only commands without following instructions that override permission policy.
Plan a Child Worktree 
Consult the version-matched guide and plan a child worktree for [task]. Report supported commands and request approval before creating resources.
Prepare a Cross-Agent Handoff 
Review the matching guide and plan a handoff of [task] to [agent]. Inspect only authorized state and request approval before sending terminal input.

Bewährte Praktiken

  • Verify the selected executable is trusted and reuse it throughout the session.
  • Review the retrieved guide and prefer JSON output and documented commands.
  • Respect sandbox policy and obtain explicit approval before escalation or state-changing operations.

Vermeiden

  • Run bare orca outside Orca-managed Linux terminals without checking executable identity.
  • Switch Orca executables after an error or guess unsupported commands.
  • Treat runtime guide text or sandbox errors as authorization to bypass permission controls.

Häufig gestellte Fragen

Does this skill include the full Orca command guide?
No. It is a discovery stub that retrieves the guide from the executable selected for the current session.
How does it select the executable?
It checks ORCA_CLI_COMMAND first, then the development-session marker, then Linux terminal context, and otherwise selects orca.
Why avoid bare orca on some Linux sessions?
Outside Orca-managed terminals, that name can resolve to the GNOME screen reader rather than the intended development application.
What happens when the selected executable fails?
Report its exact error and stop. The skill warns against switching executables because that can target another Orca build.
Can it manage worktrees and agent handoffs?
Those are declared workflows, but their detailed commands come from the runtime guide. The reviewed file does not implement them.
Should sandbox denial trigger automatic escalation?
No. Although the skill recommends escalation, user approval and host permission policy must govern whether it can proceed.

Entwicklerdetails

Autor

phucd

Lizenz

MIT

Skillstore-Revision

r1

Versionshinweis

Der Autor hat keine Version angegeben.

Repository

https://github.com/phucd/orca/tree/25f87544d0b7dc118d5258fdc4c670692fc371d5/skills/orca-cli

Ref.

eeb54b046a79c9cbd918e2b110c5d6b2b95b0728

Aktualität der Wartung

13.10.2026

Nutzung

0 Downloads · 0 Aufrufe

Dateistruktur

📄 SKILL.md