中文導讀（編輯整理）
未見惡意程式跡象；著重 agent、憑證與手機權限；此輪未驗證 relay 加密。
實際閱讀範圍：程式庫結構、package.json 與文件；未逐行稽核原始碼。
下載完整英文原文 · SHA-256 1113f86b2aeb90e4b0bc220b6471085ec9182f3977d110eee6b9c94ebc5f36e4
完整英文原始回覆（未翻譯）
I found no signs of malware in Orca. It’s an MIT-licensed, actively developed desktop app from stablyai. The commit you linked belongs to the official repo: GitHub shows no “may belong to a fork” warning, and it’s a normal feature commit. The real risk comes from what the tool is built to do, not from anything hidden in it. I reviewed the repo structure, package.json and the docs, but I didn’t audit the source line by line. The codebase is large: src/main alone has over 100 modules.
Risks that come with how it works
- It runs AI agents with your user permissions. Orca launches Claude Code, Codex, Cursor, Gemini and other agents in real terminals (
node-pty). Anything an agent does, like running shell commands, editing files or pushing to git, happens as you. Orca organizes the agents but doesn’t sandbox them; worktrees keep code changes apart, not system access. - Credential access. There are modules for
credentials,macos-keychain, and account switching for Claude, Codex, Cursor and Grok. To switch accounts, it reads and swaps those tools’ login tokens. That’s useful, but it means one app holds all your AI subscription credentials. - Computer Use. This lets agents control desktop apps and whatever is on screen. It’s the most powerful feature, so leave it off unless you need it.
- Mobile remote control. A paired phone can send prompts to agents on your desktop, which effectively gives it remote access to your terminal. The App Store listing says pairing uses a desktop keypair shared by QR code, with encrypted traffic, over the local network only. However, the repo includes a
cloud/relay that stablyai runs on GCP, and I couldn’t confirm from the docs whether that relay traffic is end-to-end encrypted. Thetweetnacldependency suggests it is. Treat the pairing QR code like a password, and don’t pair a phone if you don’t need to. - SSH worktrees and integrations. It uses your SSH keys (
ssh2) and stores GitHub, GitLab, Linear and Jira tokens, so if Orca were ever compromised, those accounts would be exposed too.
Trust and supply chain
-
Auto-update: it uses
electron-updater, so you trust whatever stablyai ships in future versions, not just this commit. Windows builds are signed through SignPath. -
Telemetry: anonymous usage data goes to PostHog in the US and appears to be on by default. According to the docs it doesn’t include prompts, file paths, repo names or terminal contents. To turn it off, use Settings → Privacy, or set
DO_NOT_TRACK=1orORCA_TELEMETRY_DISABLED=1. -
Building from source carries the usual npm risks:
- a
postinstallscript that builds packages and rebuilds native modules - a dependency pulled directly from GitHub (
github:dmmulroy/anti-slop, pinned to a specific commit) - several prerelease or beta packages
Nothing looks malicious, but it’s a large dependency tree. Installing the signed release or the Homebrew cask carries less of this risk than running
pnpm installyourself. - a
Bottom line
Installing it is about as risky as installing any widely used Electron developer tool. The bigger question is whether you’re comfortable letting several autonomous agents run with your permissions and credentials. To limit the risk:
- Install signed builds from GitHub Releases, onorca.dev or Homebrew.
- Turn off telemetry if you prefer.
- Leave Computer Use and mobile pairing off unless you need them.
- Set each agent’s own permission controls (for example, Claude Code’s permission modes) instead of skipping approvals.
- For sensitive work, run it on a separate machine, VM or user account that doesn’t hold production credentials.
I can look closer at a specific area if you want, such as the relay encryption code in cloud/packages/relay-contract or how credentials are stored.
Sources: