Навыки orca-per-workspace-env

📦

orca-per-workspace-env

Name: orca-per-workspace-env
Author: stablyai

Ревизия содержимого r1 Высокий риск ⚙️ Внешние команды

Configure Orca Workspace Environments

Per-workspace environment recipes can fail because CLI selection and provider lifecycle details vary. This skill loads Orca guidance matched to the active version.

Поддерживает: Claude Codex Code(CC)

⚠️ 38 Плохо

Остановитесь и запросите подтверждение перед установкой.

Проверьте план и получите явное согласие пользователя перед изменением файлов.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "orca-per-workspace-env" from https://skillstore.io/skills/stablyai-orca-per-workspace-env.md and its manifest at https://skillstore.io/api/skills/stablyai-orca-per-workspace-env/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/stablyai-orca-per-workspace-env.md Подписанный manifest GET /api/skills/stablyai-orca-per-workspace-env/manifest Подписанный lockfile GET /api/skills/stablyai-orca-per-workspace-env/lockfile

Протестировать

Использование «orca-per-workspace-env». Determine the Orca executable for a managed WSL session.

Ожидаемый результат:

Use the executable specified by the managed session after validating it. Keep that selection for every later Orca command.

Использование «orca-per-workspace-env». Explain why recipe doctor fails during environment startup.

Ожидаемый результат:

The failure occurs during the provider startup stage.
Verify the lifecycle script, required inputs, and cleanup behavior against the version-matched guide.
Report the exact CLI error if the selected executable cannot run.

Аудит безопасности

Высокий риск

v1 • 10.09.2026 Открыть версионный отчет

All 17 static alerts are false positives caused by Markdown formatting or prose references to command shells. However, executable selection from an environment variable and runtime loading of unaudited guidance create high-risk trust boundaries.

Просканировано файлов

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (2)

Высокий

SKILL.md:18-21

Environment-Controlled Executable Selection

The skill directs the agent to use the full ORCA_CLI_COMMAND value as its executable without validation. A manipulated environment can trigger arbitrary commands.

The instruction directly delegates executable selection to an environment variable. Exploitation depends on another actor controlling that session variable.

Высокий

SKILL.md:14 SKILL.md:35-39

Runtime Loading of Unaudited Instructions

The audited file is a discovery stub that loads its operational guide at runtime. Retrieved instructions can change behavior beyond this report.

The file explicitly identifies itself as a discovery stub and provides a command that retrieves the substantive guide.

Факторы риска

⚙️ Внешние команды (17)

SKILL.md:7 SKILL.md:8 SKILL.md:20 SKILL.md:22 SKILL.md:23 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:28 SKILL.md:29 SKILL.md:37-39 SKILL.md:39-41 SKILL.md:41 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:30 SKILL.md:30

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/stablyai-orca-per-workspace-env/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/stablyai-orca-per-workspace-env/security.svg)](https://skillstore.io/skills/stablyai-orca-per-workspace-env?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/stablyai-orca-per-workspace-env?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/stablyai-orca-per-workspace-env/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/stablyai-orca-per-workspace-env.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

stablyai. (2026). orca-per-workspace-env security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/stablyai-orca-per-workspace-env/audits/1

Цитата BibTeX

@techreport{stablyai-stablyai-orca-per-workspace-env-2026,
  author = {stablyai},
  title = {orca-per-workspace-env security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/stablyai-orca-per-workspace-env/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "orca-per-workspace-env security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "stablyai"
date-released: "2026-09-10"
url: "https://skillstore.io/skills/stablyai-orca-per-workspace-env/audits/1"
identifiers:
  - type: other
    value: "skillstore:stablyai-orca-per-workspace-env:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Create a workspace recipe

Build a disposable environment recipe and verify its provider lifecycle steps.

Repair recipe configuration

Review an environmentRecipes entry and resolve validation or doctor failures.

Select the correct CLI

Determine which Orca executable matches the current local, WSL, or managed session.

Попробуйте эти промпты

Check my Orca session

Identify the correct Orca executable for this session. Explain the evidence and stop if the selected executable fails.

Validate a recipe

Review my environmentRecipes entry, load the version-matched guide, and identify configuration errors without guessing unsupported fields.

Diagnose doctor output

Analyze this Orca recipe doctor failure. Trace it to the recipe or provider lifecycle stage and propose verified corrections.

Design a provider workflow

Design a complete per-workspace environment recipe for my provider. Include lifecycle responsibilities, validation steps, failure handling, and cleanup requirements.

Лучшие практики

Resolve the Orca executable once and reuse it throughout the session.
Prefer structured command output when the installed CLI supports it.
Stop and report exact errors instead of switching silently to another Orca build.

Избегать

Do not run bare orca on Linux outside an Orca-managed terminal.
Do not execute the ORCA placeholder literally or store it as a shell variable.
Do not guess unsupported commands, flags, or recipe fields.

Часто задаваемые вопросы

What is a per-workspace environment?

It is a disposable runtime that Orca creates separately for each workspace.

Which environment providers are supported?

The description covers cloud sandboxes, virtual machines, SSH hosts, and local containers. Exact support depends on the loaded guide.

Does this skill create ordinary worktrees?

No. Use the separate orca-cli skill for workspace and worktree creation without environment recipes.

Why should I avoid bare orca on Linux?

Outside managed terminals, that name can resolve to the GNOME Orca screen reader instead of the intended CLI.

What happens when the selected executable fails?

Report the exact error and stop. Switching executables can silently target a different Orca build.

Can the skill use commands missing from the guide?

Use CLI help for read-only discovery. Do not guess commands or flags that the guide does not cover.

Сведения для разработчиков

Автор

stablyai

Лицензия

MIT

Ревизия Skillstore

Примечание о версии

Автор не указал версию.

Репозиторий

https://github.com/stablyai/orca/tree/f2d5711b2d32e9f11277cd63805c76b0b5f9ddf7/skills/orca-per-workspace-env

Ссылка

7c99d96a0368287ee77cc6e97121e473c91ab0a5

Актуальность поддержки

11.09.2026

Использование

1 загрузок · 0 просмотров

Структура файлов

📄 SKILL.md