Skills orca-emulator

📦

orca-emulator

Name: orca-emulator
Author: stablyai

Content revision r1 High Risk ⚙️ External commands

Control iOS Simulators Through Orca

iOS testing often requires switching between agent tools, simulator controls, and evidence collection. This skill routes simulator interaction through Orca and loads guidance matched to the active CLI.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "orca-emulator" from https://skillstore.io/skills/stablyai-orca-emulator.md and its manifest at https://skillstore.io/api/skills/stablyai-orca-emulator/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/stablyai-orca-emulator.md Signed manifest GET /api/skills/stablyai-orca-emulator/manifest Signed lockfile GET /api/skills/stablyai-orca-emulator/lockfile

Test it

Using "orca-emulator". Inspect the current simulator screen and identify the primary action.

Expected outcome:

The simulator shows the sign-in screen. The primary accessible action is Sign In, below the email and password fields.

Using "orca-emulator". Rotate the simulator and verify the checkout screen.

Expected outcome:

The checkout screen remained visible in landscape orientation. The order summary and Place Order control were accessible without overlap.

Using "orca-emulator". Reproduce the failed profile update and collect evidence.

Expected outcome:

Opened Profile and changed the display name.
Tapped Save and observed an error banner.
The original name remained after reopening the screen.

Security Audit

High Risk

v1 • 9/26/2026 Open versioned report

Most alerts are false positives caused by Markdown inline code and prose references to shells. Confirmed risks include environment-controlled command selection and retrying an Orca command with elevated permissions. The stub also delegates instructions to an unaudited guide, which weakens marketplace review coverage.

Files scanned

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:15 SKILL.md:39-43

Unaudited Dynamic Instruction Loading

The package is a stub that directs the agent to load a version-matched guide from an executable. That guide is outside this audit.

The file explicitly calls itself a discovery stub and requires loading another guide before commands. The retrieved instructions are absent from the audited package.

High

SKILL.md:47-48

Unscoped Privilege Escalation Directive

The skill tells the agent to rerun a denied command with elevated permissions. It does not require user approval or define the required scope.

The escalation instruction is explicit and unconditional after a named error. No approval checkpoint or least-privilege boundary is provided.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:24

Ruby/shell backtick execution

- If the `ORCA_CLI_COMMAND` environment variable is set, use its value. Orca exports this

Although the backticks are Markdown, line 24 directs the agent to execute an environment-controlled value. A modified environment can select an unintended command.

High

SKILL.md:48-49

Ruby/shell backtick execution

re-run it with escalated permissions, and do not run `ORCA open` or restart Orca. If

Line 48 instructs the agent to rerun a command with elevated permissions without requiring user approval or limiting the permission scope.

Medium

SKILL.md:46-47

Ruby/shell backtick execution

not cover. If a command reports that Orca is not running, start it with `ORCA open --json`

Line 46 directs the agent to run the selected executable. If selection came from ORCA_CLI_COMMAND, this can invoke an environment-controlled command.

Risk Factors

⚙️ External commands (18)

SKILL.md:17 SKILL.md:24 SKILL.md:26 SKILL.md:27 SKILL.md:28 SKILL.md:29 SKILL.md:30 SKILL.md:32 SKILL.md:33 SKILL.md:41-43 SKILL.md:43-45 SKILL.md:45 SKILL.md:46-47 SKILL.md:47-48 SKILL.md:48-49 SKILL.md:49 SKILL.md:34 SKILL.md:34

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/stablyai-orca-emulator/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/stablyai-orca-emulator/security.svg)](https://skillstore.io/skills/stablyai-orca-emulator?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/stablyai-orca-emulator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/stablyai-orca-emulator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/stablyai-orca-emulator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

stablyai. (2026). orca-emulator security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/stablyai-orca-emulator/audits/1

BibTeX citation

@techreport{stablyai-stablyai-orca-emulator-2026,
  author = {stablyai},
  title = {orca-emulator security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/stablyai-orca-emulator/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "orca-emulator security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "stablyai"
date-released: "2026-09-26"
url: "https://skillstore.io/skills/stablyai-orca-emulator/audits/1"
identifiers:
  - type: other
    value: "skillstore:stablyai-orca-emulator:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Verify an iOS Change

Drive the changed interface and collect simulator evidence for a review.

Repeat Interface Checks

Perform consistent taps, typing, gestures, and rotation during exploratory testing.

Inspect Accessible Interfaces

Review the simulator accessibility tree while investigating labels, controls, and navigation.

Try These Prompts

Open and Inspect

Use Orca to inspect the booted iOS Simulator. Report the visible screen and available accessibility elements before taking action.

Complete a Basic Flow

Use Orca to open [app], tap [control], enter [text], and report the final visible state.

Verify a UI Change

Test [feature] in the booted simulator. Exercise [steps], inspect accessibility labels, and collect evidence for the expected result.

Investigate a Stateful Failure

Reproduce [failure] through Orca across [orientations or states]. Record each action, observed result, accessibility evidence, and the earliest divergence.

Best Practices

Resolve the Orca executable once and use the same executable throughout the session.
Inspect the current screen and accessibility tree before issuing interactions.
Record expected and observed states when collecting simulator evidence.

Avoid

Do not use this skill for Android devices or emulators.
Do not guess unsupported Orca commands when help output is available.
Do not change executables after a failure because another build may target different session state.

Frequently Asked Questions

What platform does this skill support?

It supports a booted Apple iOS Simulator on macOS through Orca.

Can it build and install my application?

No. Build and install the application with Xcode tooling or simctl before using this skill.

Does it support Android emulators?

No. Use the separate Android emulator skill for Android devices and emulators.

What interactions can it guide?

It covers taps, gestures, typing, hardware buttons, rotation, accessibility inspection, and evidence collection.

Why does it load another guide?

It requests guidance matched to the active Orca executable and session version.

What should happen when the selected executable fails?

Report the exact error and stop. Do not switch to another Orca executable.

Developer Details

Author

stablyai

License

Apache-2.0

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/stablyai/orca/tree/da6d483ab9aae8aa81eaf773bcf0fda9fc4e3495/skills/orca-emulator

Ref

1cda4003aa9ea65a9606af00b33e9c706ef03e62

Maintenance freshness

9/30/2026

Usage

0 downloads · 0 views

File structure

📄 SKILL.md