orca-cli — security audits

Flagged by auditors

Independent security partners scan this skill's files for malicious content, prompt injection and risky patterns. Verdicts below come from the skills.sh audit program; each partner links to its full report.

• Gen Agent Trust Hub

  pass

  This skill enables management of Orca worktrees, terminals, and browser automation. It exposes a surface for indirect prompt injection by ingesting data from web pages and terminal outputs without explicit boundary markers or sanitization, which could potentially influence the agent's use of its powerful shell and browser execution capabilities.

  Risk: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONMay 20, 2026Full report

• Socket

  pass

  No alerts

  May 20, 2026Full report

• Snyk

  fail

  Risk: HIGH · 2 issues

  Risk: HIGHMay 20, 2026Full report

• ZeroLeaks

  pass

  Score: 93/100 · 2 sections analyzed

  Risk: NONEApr 16, 2026Full report