中文導讀（編輯整理）
找到預設啟用的權限繞過啟動參數；建議改為 Manual 權限並隔離試用。
實際閱讀範圍：agent 啟動預設／權限、啟動整合、瀏覽器安全與遙測同意。
下載完整英文原文 · SHA-256 2cab8480b051b16cff8fd74c303446df7cadc236b02a4cbcb04b5d94668d8e44
完整英文原始回覆（未翻譯）
Yes. At commit 7a06b657, I found a significant unsafe default: Orca launches supported agents with permission bypass enabled unless you configure otherwise. I would change that before using it on a machine with valuable code or credentials.
The main findings:
- High risk — agent safeguards bypassed by default. Default arguments include Claude’s
--dangerously-skip-permissionsand Codex’s--dangerously-bypass-approvals-and-sandbox. The launch resolver explicitly falls back to these when settings are untouched. A malicious instruction in repository content, or an agent mistake, could therefore lead to commands running without the usual approval or sandbox protections. Launch defaults, bypass flags. - Sensitive local integration. Startup initializes account/auth services, schedules eligible Codex session migration, and reconciles managed agent hooks. This makes Orca part of your credential and agent-configuration trust boundary. These are intended features, but increase the impact of a compromise. Account initialization, hook initialization.
- Some useful defenses exist. Browser guests have Node integration disabled, context isolation enabled, sandboxing enabled, and partition checks. The telemetry consent resolver supports opt-out and
ORCA_TELEMETRY_DISABLED=1. Those controls do not mitigate agents running with bypass flags. Browser controls, telemetry controls.
My recommendation: test it under a separate OS account or VM without production secrets. Set Agent Permissions to Manual, inspect custom launch arguments, and verify new sessions no longer include bypass flags. A Git worktree alone does not isolate an agent from your machine.
This was a targeted source review, not a complete audit. I did not install or execute Orca, audit every dependency, or verify that downloadable binaries match this commit. I found an unsafe runtime default; I have not established that the installer is malicious.
Fixed but not yet released (awaiting review): Nothing.