Skills/Glama/orca

orca@r1

VERIFIED

Publisher claims: "The server enables users to manage and route text and code generation requests from platforms like Codex to various local or online Large Language Models on macOS. It provides centralized model and tool management, offering real-time status and queue visibility via a Menu Bar." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher karugamo5 · joined 0 days agoInstalls 0Last detonated 2 h ago
$npx skills add orca
WatchReport an issue

Is orca@r1 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios) on 2026-11-06 and scored it 82/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.1sprocessexec /usr/bin/dirname
0.1sprocessexited 2: install.py: error: macOS and Python 3.11 or later are required
0.2sprocessdependency install exit 1
0.2sprocessexec /usr/bin/date
0.2sprocessexec /usr/bin/timeout
0.2sprocessexec .venv/bin/orca
0.2sclaimedno tools/list reply (exit 0)
0.2sprocessscript backend runs setup only
0.3sprocesssecond launch, clock +45 days, CI unset
0.4sprocessexec /usr/bin/faketime
0.4sprocessexec /usr/bin/dirname
0.4sprocessexited 2: install.py: error: macOS and Python 3.11 or later are required

Static findings

MEDIUM
Python subprocess execution detectedtools/check_release.py:50 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/orca/installation.py:181 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Prompt injectionthird_party/THIRD_PARTY_NOTICES.md:1711 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Process kill commandsrc/orca/platforms/macos.py:338 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/orca/release_source.py:58 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/orca/model_manager.py:349 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/orca/platforms/macos.py:264 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/orca/installation.py:194 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionsrc/orca/storage.py:124 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Prompt injectionthird_party/THIRD_PARTY_NOTICES.md:1709 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Python subprocess execution detectedsrc/orca/cli.py:49 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/orca/installation.py:187 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/orca/installation.py:182 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/orca/model_manager.py:193 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Prompt injectionthird_party/THIRD_PARTY_NOTICES.md:1710 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Python subprocess execution detectedsrc/orca/installation.py:179 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtools/release.py:20 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈30 tok
1 file · 49 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.