Habilidades orca-per-workspace-env

📦

orca-per-workspace-env

Name: orca-per-workspace-env
Author: stablyai

Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos

Configure Orca Workspace Environments

Per-workspace environment recipes can fail because CLI selection and provider lifecycle details vary. This skill loads Orca guidance matched to the active version.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "orca-per-workspace-env" from https://skillstore.io/skills/stablyai-orca-per-workspace-env.md and its manifest at https://skillstore.io/api/skills/stablyai-orca-per-workspace-env/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/stablyai-orca-per-workspace-env.md Manifest firmado GET /api/skills/stablyai-orca-per-workspace-env/manifest Lockfile firmado GET /api/skills/stablyai-orca-per-workspace-env/lockfile

Pruébalo

Usando "orca-per-workspace-env". Determine the Orca executable for a managed WSL session.

Resultado esperado:

Use the executable specified by the managed session after validating it. Keep that selection for every later Orca command.

Usando "orca-per-workspace-env". Explain why recipe doctor fails during environment startup.

Resultado esperado:

The failure occurs during the provider startup stage.
Verify the lifecycle script, required inputs, and cleanup behavior against the version-matched guide.
Report the exact CLI error if the selected executable cannot run.

Auditoría de seguridad

Riesgo alto

v1 • 10/9/2026 Abrir el informe versionado

All 17 static alerts are false positives caused by Markdown formatting or prose references to command shells. However, executable selection from an environment variable and runtime loading of unaudited guidance create high-risk trust boundaries.

Archivos escaneados

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (2)

Alto

SKILL.md:18-21

Environment-Controlled Executable Selection

The skill directs the agent to use the full ORCA_CLI_COMMAND value as its executable without validation. A manipulated environment can trigger arbitrary commands.

The instruction directly delegates executable selection to an environment variable. Exploitation depends on another actor controlling that session variable.

Alto

SKILL.md:14 SKILL.md:35-39

Runtime Loading of Unaudited Instructions

The audited file is a discovery stub that loads its operational guide at runtime. Retrieved instructions can change behavior beyond this report.

The file explicitly identifies itself as a discovery stub and provides a command that retrieves the substantive guide.

Factores de riesgo

⚙️ Comandos externos (17)

SKILL.md:7 SKILL.md:8 SKILL.md:20 SKILL.md:22 SKILL.md:23 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:28 SKILL.md:29 SKILL.md:37-39 SKILL.md:39-41 SKILL.md:41 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:30 SKILL.md:30

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/stablyai-orca-per-workspace-env/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/stablyai-orca-per-workspace-env/security.svg)](https://skillstore.io/skills/stablyai-orca-per-workspace-env?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/stablyai-orca-per-workspace-env?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/stablyai-orca-per-workspace-env/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/stablyai-orca-per-workspace-env.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

stablyai. (2026). orca-per-workspace-env security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/stablyai-orca-per-workspace-env/audits/1

Cita BibTeX

@techreport{stablyai-stablyai-orca-per-workspace-env-2026,
  author = {stablyai},
  title = {orca-per-workspace-env security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/stablyai-orca-per-workspace-env/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "orca-per-workspace-env security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "stablyai"
date-released: "2026-09-10"
url: "https://skillstore.io/skills/stablyai-orca-per-workspace-env/audits/1"
identifiers:
  - type: other
    value: "skillstore:stablyai-orca-per-workspace-env:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Create a workspace recipe

Build a disposable environment recipe and verify its provider lifecycle steps.

Repair recipe configuration

Review an environmentRecipes entry and resolve validation or doctor failures.

Select the correct CLI

Determine which Orca executable matches the current local, WSL, or managed session.

Prueba estos prompts

Check my Orca session

Identify the correct Orca executable for this session. Explain the evidence and stop if the selected executable fails.

Validate a recipe

Review my environmentRecipes entry, load the version-matched guide, and identify configuration errors without guessing unsupported fields.

Diagnose doctor output

Analyze this Orca recipe doctor failure. Trace it to the recipe or provider lifecycle stage and propose verified corrections.

Design a provider workflow

Design a complete per-workspace environment recipe for my provider. Include lifecycle responsibilities, validation steps, failure handling, and cleanup requirements.

Mejores prácticas

Resolve the Orca executable once and reuse it throughout the session.
Prefer structured command output when the installed CLI supports it.
Stop and report exact errors instead of switching silently to another Orca build.

Evitar

Do not run bare orca on Linux outside an Orca-managed terminal.
Do not execute the ORCA placeholder literally or store it as a shell variable.
Do not guess unsupported commands, flags, or recipe fields.

Preguntas frecuentes

What is a per-workspace environment?

It is a disposable runtime that Orca creates separately for each workspace.

Which environment providers are supported?

The description covers cloud sandboxes, virtual machines, SSH hosts, and local containers. Exact support depends on the loaded guide.

Does this skill create ordinary worktrees?

No. Use the separate orca-cli skill for workspace and worktree creation without environment recipes.

Why should I avoid bare orca on Linux?

Outside managed terminals, that name can resolve to the GNOME Orca screen reader instead of the intended CLI.

What happens when the selected executable fails?

Report the exact error and stop. Switching executables can silently target a different Orca build.

Can the skill use commands missing from the guide?

Use CLI help for read-only discovery. Do not guess commands or flags that the guide does not cover.

Detalles del desarrollador

Autor

stablyai

Licencia

MIT

Revisión de Skillstore

Aviso de versión

El autor no declaró una versión.

Repositorio

https://github.com/stablyai/orca/tree/f2d5711b2d32e9f11277cd63805c76b0b5f9ddf7/skills/orca-per-workspace-env

Ref.

7c99d96a0368287ee77cc6e97121e473c91ab0a5

Actualidad del mantenimiento

11/9/2026

Uso

1 descargas · 0 vistas

Estructura de archivos

📄 SKILL.md