orca@r1
VERIFIEDPublisher claims: "The server enables users to manage and route text and code generation requests from platforms like Codex to various local or online Large Language Models on macOS. It provides centralized model and tool management, offering real-time status and queue visibility via a Menu Bar." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is orca@r1 safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios) on 2026-11-06 and scored it 82/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 3 scenarios · 0 deviationst+CategoryObserved action
0.1sprocessexec /usr/bin/dirname
0.1sprocessexited 2: install.py: error: macOS and Python 3.11 or later are required
0.2sprocessdependency install exit 1
0.2sprocessexec /usr/bin/date
0.2sprocessexec /usr/bin/timeout
0.2sprocessexec .venv/bin/orca
0.2sclaimedno tools/list reply (exit 0)
0.2sprocessscript backend runs setup only
0.3sprocesssecond launch, clock +45 days, CI unset
0.4sprocessexec /usr/bin/faketime
0.4sprocessexec /usr/bin/dirname
0.4sprocessexited 2: install.py: error: macOS and Python 3.11 or later are required
Static findings
MEDIUM
Python subprocess execution detectedtools/check_release.py:50 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/orca/installation.py:181 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05LOW
Prompt injectionthird_party/THIRD_PARTY_NOTICES.md:1711 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01MEDIUM
Process kill commandsrc/orca/platforms/macos.py:338 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05MEDIUM
Python subprocess execution detectedsrc/orca/release_source.py:58 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/orca/model_manager.py:349 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/orca/platforms/macos.py:264 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/orca/installation.py:194 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
File type combined with upload actionsrc/orca/storage.py:124 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07LOW
Prompt injectionthird_party/THIRD_PARTY_NOTICES.md:1709 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01MEDIUM
Python subprocess execution detectedsrc/orca/cli.py:49 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/orca/installation.py:187 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/orca/installation.py:182 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Process kill commandsrc/orca/model_manager.py:193 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05LOW
Prompt injectionthird_party/THIRD_PARTY_NOTICES.md:1710 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01MEDIUM
Python subprocess execution detectedsrc/orca/installation.py:179 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedtools/release.py:20 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05Cost to the agent
Instructions loaded
≈30 tok
1 file · 49 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.