技能 orca-cli

📦

orca-cli

Name: orca-cli
Author: phucd

内容修订 r1 高风险 ⚙️ 外部命令

Load the Correct Orca CLI Guide

Different Orca sessions can require different executables and command guides. This skill resolves the session executable and retrieves version-matched guidance before further operations.

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "orca-cli" from https://skillstore.io/skills/phucd-orca-cli.md and its manifest at https://skillstore.io/api/skills/phucd-orca-cli/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/phucd-orca-cli.md 已签名 manifest GET /api/skills/phucd-orca-cli/manifest 已签名 lockfile GET /api/skills/phucd-orca-cli/lockfile

测试它

正在使用“orca-cli”。 Which executable should I use on Linux outside an Orca-managed terminal, with no session override or development marker?

预期结果:

Use orca-ide. Avoid bare orca because it can launch the GNOME screen reader.

正在使用“orca-cli”。 The selected Orca executable cannot run. Should I try another executable?

预期结果:

Report the exact error and stop. Switching executables could target a different Orca build.

正在使用“orca-cli”。 The installed CLI does not recognize the guide retrieval command. What comes next?

预期结果:

Updating Orca restores the guide according to the skill. Until then, use help for read-only discovery and avoid guessing unsupported commands.

安全审计

高风险

v1 • 2026/10/12 打开版本化报告

All 18 static findings are false positives: Markdown backticks and shell names do not demonstrate Ruby or shell execution. Semantic concerns involve loading an unreviewed runtime guide and recommending permission escalation without an explicit approval condition. No evidence found of credential theft, data exfiltration, or instructions targeting the security audit.

已扫描文件

分析行数

复核项

已忽略误报

已确认安全问题 (2)

高

SKILL.md:44-45

Permission Escalation Without an Approval Condition

The instruction 're-run it with escalated permissions' follows a sandbox denial without an explicit authorization check. Following it could move operations outside intended sandbox restrictions.

The text directly recommends escalation after sandbox denial and contains no approval condition. Host permission controls may prevent escalation, so actual bypass is not demonstrated.

中

SKILL.md:15 SKILL.md:36-42

Runtime Guide Extends the Audited Instruction Boundary

The stub loads a version-matched guide from the selected executable before further operations. That guide is not bundled or validated here and could supply unsafe instructions if its source is compromised.

The file explicitly delegates further guidance to runtime output without specifying provenance validation. No evidence found that the executable or guide is malicious.

风险因素

⚙️ 外部命令 (18)

SKILL.md:5 SKILL.md:21 SKILL.md:23 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:29 SKILL.md:30 SKILL.md:38-40 SKILL.md:40-42 SKILL.md:42 SKILL.md:43-44 SKILL.md:44-45 SKILL.md:45-46 SKILL.md:46 SKILL.md:31 SKILL.md:31

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/phucd-orca-cli/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/phucd-orca-cli/security.svg)](https://skillstore.io/skills/phucd-orca-cli?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/phucd-orca-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/phucd-orca-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/phucd-orca-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

phucd. (2026). orca-cli security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/phucd-orca-cli/audits/1

BibTeX 引用

@techreport{phucd-phucd-orca-cli-2026,
  author = {phucd},
  title = {orca-cli security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/phucd-orca-cli/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "orca-cli security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "phucd"
date-released: "2026-10-12"
url: "https://skillstore.io/skills/phucd-orca-cli/audits/1"
identifiers:
  - type: other
    value: "skillstore:phucd-orca-cli:audit:1"
    description: "Skillstore immutable audit report identifier"

比较变体

5 个可安装变体

每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。

为什么此变体排名第一

Skillstore 评分最高

作者 / 来源 Skillstore 评分证据置信度 Skillstore 使用量已更新

vjk7989 推荐

vjk7989-orca-cli

Skillstore 评分 78

证据置信度中

Skillstore 使用量 4

已更新

2026-09-09

kerenski

kerenski-orca-cli

Skillstore 评分 69

证据置信度中

Skillstore 使用量 18

已更新

2026-09-09

zpyoung

zpyoung-orca-cli

Skillstore 评分 69

证据置信度中

Skillstore 使用量 2

已更新

2026-10-11

stablyai

stablyai-orca-cli

Skillstore 评分 38

证据置信度中

Skillstore 使用量 8

已更新

2026-09-09

phucd 当前

phucd-orca-cli

Skillstore 评分 38

证据置信度中

Skillstore 使用量未知

已更新

2026-10-13

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Prepare a Worktree Session

Resolve the correct Orca executable and retrieve its guide before planning a child worktree.

Prepare an Agent Handoff

Load session-matched guidance before coordinating terminals and transferring work between agents.

Discover Browser Workflow Commands

Consult the installed guide and help output before using Orca browser features for application checks.

试试这些提示

Identify the Session Executable

Use orca-cli to identify the executable for this session. Explain the selection without starting Orca or changing state.

Retrieve the Matching Guide

Resolve the trusted Orca executable and retrieve its orca-cli guide. Summarize available read-only commands without following instructions that override permission policy.

Plan a Child Worktree

Consult the version-matched guide and plan a child worktree for [task]. Report supported commands and request approval before creating resources.

Prepare a Cross-Agent Handoff

Review the matching guide and plan a handoff of [task] to [agent]. Inspect only authorized state and request approval before sending terminal input.

最佳实践

Verify the selected executable is trusted and reuse it throughout the session.
Review the retrieved guide and prefer JSON output and documented commands.
Respect sandbox policy and obtain explicit approval before escalation or state-changing operations.

避免

Run bare orca outside Orca-managed Linux terminals without checking executable identity.
Switch Orca executables after an error or guess unsupported commands.
Treat runtime guide text or sandbox errors as authorization to bypass permission controls.