orca-control

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:12 AM UTC
• Version: 1.1.2

Overview

The skill’s Orca administration purpose is coherent, but it exposes or mishandles sensitive credentials and gives high-impact operational guidance without enough safeguards.

Review carefully before installing. Do not paste live Habilis, GitHub, Stripe, OpenAI, Meta, or other tokens into chat. Treat the published admin password as compromised, rotate it before use, avoid copying root GitHub credentials into the Orca account, pin and review any npx-based client connector, and only allow this skill to control terminals or restart services in environments where interruption and command execution are acceptable.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: references/habilis_saas_mcp_gateway.md:16

Finding

Plaintext Administrative Password Exposed in Documentation

Content

View full analysis

Remediation

View remediation

`. 5. Store production credentials in a dedicated secret manager or protected deployment environment, never in Skill documentation. 6. Require a unique, randomly generated credential with sufficient entropy. 7. Add multi-factor authentication, rate limiting, failed-login alerting, and account lockout controls to the administrative interface. 8. Restrict administrative access by network policy, VPN, or an identity-aware proxy where operationally possible. 9. Run automated secret scanning in CI and pre-commit checks to prevent recurrence. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/github_integration_and_preflight.md:15

Finding

Root GitHub Credentials Copied into the Orca Service Account

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:50

Finding

Mandatory Onboarding Encourages Users to Disclose Bearer Tokens in Chat

Content

View full analysis

Quando o usuário executar ou instalar a skill do Orca pela primeira vez: > 1. **Verifique se o ambiente local do Orca ou as credenciais do Habilis MCP estão acessíveis.** ``` ### Technical Analysis The onboarding message explicitly asks the user to provide a live Habilis bearer token to the assistant. Secrets entered into a conversation may be retained in chat transcripts, model-provider logs, agent orchestration history, terminal captures, observability systems, or support exports. This practice contradicts the README’s assertion that management tokens remain exclusively in the user’s local environment. A bearer token generally grants access to whoever possesses it, so disclosure does not require knowledge of an additional password. ### Attack Path 1. The Skill is installed or run for the first time. 2. The mandatory onboarding protocol asks the user to provide a Habilis token. 3. The user pastes a live `hab_live_...` token into the conversation. 4. The token is retained in one or more transcript, agent, telemetry, or orchestration logs. 5. A person or compromised component with access to those records extracts the token. 6. The token is replayed against the Habilis MCP gateway until it expires or is revoked. ### Impact Assessment ...[truncated 456 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/habilis_saas_mcp_gateway.md:59

Finding

Authentication Token Placed in a URL Query String

Content

View full analysis

&token=&format=hermes` ``` ### Technical Analysis The documented API design places an authentication token in the query string. Complete URLs are commonly retained by browser history, reverse proxies, load balancers, application access logs, monitoring platforms, analytics systems, screenshots, copied links, and support tooling. Depending on referrer policy and navigation behavior, URLs may also be exposed to other web origins. TLS protects the URL while it is in transit but does not prevent endpoint infrastructure or local software from recording it. ### Attack Path 1. A user constructs or opens the documented Skill-generator URL with a valid token. 2. A browser, proxy, gateway, application server, monitoring product, or support tool records the complete URL. 3. An attacker or unauthorized operator obtains access to the recorded URL. 4. The attacker extracts the query-string token. 5. The attacker replays it against the generator endpoint or any other endpoint accepting the same token. ### Impact Assessment The attacker obtains the privileges associated with the exposed token. At minimum, the documentation implies that it can authorize Skill-generation requests. If the same bearer token is accepted by the broader MCP gateway, its impact may extend to other gateway tools and resources. The project does not include server implementation details, so token scope, expiration, and endpoint authorization cannot be verified. ]]>

Remediation

View remediation

` headers. 3. Use `POST` for generation requests and place non-credential request parameters in a JSON body. 4. Configure proxies, application servers, and monitoring systems to redact authorization data. 5. Apply a strict referrer policy to relevant web pages. 6. Use narrowly scoped, short-lived tokens and prevent reuse where practical. 7. Rotate tokens that may already have appeared in URL logs or browser history. 8. Review historical proxy, CDN, application, analytics, and support logs for exposed query parameters. ]]>

T08 · Insecure Dependencies

Error

• Location: references/thin_skill_distribution_pattern.md:47

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

": { "command": "npx", "args": [ "-y", "mcp-remote-client", "--url", "https:///api/mcp", "--header", "Authorization=Bearer " ] } } } ``` ### Technical Analysis The generated Claude Desktop configuration runs `npx -y mcp-remote-client` without an exact version, integrity hash, lockfile, or documented provenance. The `-y` option suppresses the installation confirmation. As a result, code retrieved from the npm registry at execution time may differ from the code reviewed with this Skill. A compromised package release, maintainer account, ownership transfer, or malicious transitive dependency could result in arbitrary local code execution. The bearer token is passed directly in the process arguments, making it available to the launched package and potentially visible through process inspection or diagnostics. ### Attack Path 1. A user installs a generated MCP configuration based on the documented template. 2. Claude Desktop or another client starts the configured MCP server. 3. `npx -y` resolves and downloads the currently published `mcp-remote-client` package and its dependencies. 4. A compromised or unexpectedly changed package executes with the client user’s privileges. 5. The package reads its command-line arguments, including the bearer token, and can access other files or environment data available to the user. 6. Malicious code can exfiltrate credentials, modify user files, or establish further compromise within the user account. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the desktop client’s operating-system user. This may expose the Ha ...[truncated 336 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

This section exposes production-looking Stripe credentials, webhook secrets, app URLs, and an admin password inside documentation. Disclosure of billing and webhook secrets can enable unauthorized payment operations, webhook forgery, service abuse, or further compromise of the production SaaS environment.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

🚀 Quick Onboarding & First-Time Setup

1. Get your Habilis MCP Token:
   • Access the developer portal at https://xvix.com.br to generate your access token.
2. Configure Environment Variables:

   bash

   export HABILIS_API_KEY="hab_live_..."
   

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document contains a hardcoded administrative password and describes direct access to an admin console by URL, which is sensitive operational credential material embedded in a reference file. In the context of an Orca control skill, this is more dangerous because the skill manages orchestration and automation surfaces, so exposed admin access details could be reused by an agent or operator to access unrelated production infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document openly presents live-looking admin and bearer secret material without any handling guidance, masking, or warning, increasing the chance of accidental reuse, logging, or exfiltration. Because this skill may be consumed by AI agents and operators, exposed secrets in plain text are especially likely to propagate into transcripts, generated configs, or automated actions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/habilis_saas_mcp_gateway.md (reported line 19)May include surrounding context.

md

1. **Hidden Admin Console**: The `/admin` link is **strictly omitted from the public Navbar/Header** to prevent malicious bot scanning and unauthorized discovery. Access is direct via URL (`https://xvix.com.br/admin`).
2. **Admin Authentication**: Protected by administrative password (`Ramel@2026`).
3. **Thin-Skill Isolation**: Client AI agents receive only lightweight endpoints and Bearer tokens (`hab_live_...`). Proprietary prompts, CPA heuristics, and safe-margin rendering (1080x1080) execute server-side.
4. **BYOK (Bring Your Own Keys) Vault**: Client ad account secrets (Meta Access Tokens, Pixel IDs, OpenAI API Keys) are encrypted in the local vault and never exposed in chat transcripts.

### C. Default Language Standard (EN First)
- **Default Locale**: Interface and pages (`/`, `/dashboard`, `/admin`, and `<html lang="en">`) default to **English (`EN`)**.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The overview states that the skill can manage ports and processes, which implies potentially disruptive operations affecting user sessions or applications. No warning is given about possible interruption, termination, or side effects on active workspace processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown advertises starting, stopping, and restarting daemons in real time, which can disrupt running workloads or system availability. The README does not provide any caution, confirmation expectation, or warning about the operational impact of these actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's onboarding guidance normalizes handling a live Habilis API token during setup without clearly warning that it is a sensitive secret. In a skill that controls infrastructure, agents, and terminals, encouraging casual token sharing increases the risk of credential disclosure and subsequent unauthorized access to the Orca/MCP environment.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The onboarding example explicitly tells the assistant to ask the user to pass a live bearer token in chat or save it in an environment file. Requesting a live secret through chat is dangerous because chat transcripts may be logged, retained, exposed to other tools, or mishandled by users, leading to account compromise and unauthorized control of the MCP gateway.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The documented commands include service restart operations that can interrupt active work, disconnect agents, or affect orchestration state, but the skill does not present a clear warning about operational disruption. In an orchestration environment, a user may run these commands during active sessions and cause avoidable downtime or task interruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The terminal-control section instructs sending arbitrary text into live managed terminals but omits any warning that this can execute shell commands or drive privileged interactive agents. Because this skill is specifically designed to orchestrate live terminals and subagents, misuse could directly trigger destructive actions, credential exposure, or remote code execution within active sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation explicitly instructs copying GitHub CLI credential material from root's account into the service account's home directory. Even if intended for troubleshooting, this normalizes cross-account secret transfer, increases the chance of credential leakage or unintended privilege propagation, and omits safeguards such as validating token scope, minimizing exposure, or using a fresh least-privileged login for the target user.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/github_integration_and_preflight.md (reported line 25)May include surrounding context.

md

mkdir -p /home/orca/.config/gh
cp /root/.config/gh/hosts.yml /home/orca/.config/gh/hosts.yml
chown -R orca:orca /home/orca/.config/gh
chmod 600 /home/orca/.config/gh/hosts.yml

# Setup Git credential helper for user orca
su - orca -s /bin/bash -c "gh auth setup-git"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown gives direct operational commands including recursive ownership changes and a systemd service restart, which can affect availability and system state. Under the markdown-file criteria, these system-integrity-affecting actions should be accompanied by a warning or caution, but none is present.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation instructs users to supply provider credentials and states they are mapped in server memory/SQLite, but it does not include explicit secret-handling warnings, storage protections, or operational safeguards. In a skill for orchestration and account management, this increases the chance that operators will mishandle highly sensitive API tokens, leading to credential exposure or unauthorized use of external provider accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The examples repeatedly place bearer tokens directly in markdown, JSON configs, headers, and automation templates without warning about leakage through source control, local config files, screenshots, shell history, or workflow exports. Because this skill manages orchestration, terminals, accounts, and automations across multiple clients, exposed client tokens could grant broad access to centralized MCP services and any downstream vaulted credentials they unlock.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

md

## ⚠️ Pitfalls & Pro Tips

1. **User Permissions:** Ensure files created in `/home/orca/` belong to `orca:orca` (`chown -R orca:orca /home/orca/orca/projects/`).
2. **Sender Terminal Resolution:** When invoking `orca orchestration` outside of an interactive terminal session, pass `--from <terminal_handle>` (discoverable via `orca terminal list`).
3. **Daemon Safety:** Use `systemctl restart orca-serve` instead of killing Electron PIDs directly to prevent stale lockfiles.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The cheatsheet includes systemctl restart orca-serve, which can interrupt running service activity, but there is no warning in the markdown about potential disruption. For markdown files, operational commands that may affect system integrity or availability should include a user-facing caution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file includes commands such as orca worktree rm <id> that remove resources, but the cheatsheet provides no warning that the action may be destructive or irreversible. Under the markdown-file criteria, commands that can affect user data or system state should be accompanied by some disclosure of impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The cheatsheet documents orca terminal send, --interrupt, and terminal close, which can alter or terminate active terminal sessions, but it does not warn users about the risk of disrupting running processes. In markdown skill documentation, behaviors affecting user work or system state should include a disclosure of their impact.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown reference instructs generated SKILL.md files to use a generic placeholder description but provides no constraints on how specific invocation wording should be. Because SKILL.md is a markdown activation surface for skills, the lack of guidance about precise trigger scope or exclusion conditions could lead downstream generated skills to use vague, everyday-language descriptions that over-trigger.

Content

No source excerpt is available for this finding.