菜单
Use when Pi bash/write/edit/read/discovery tool calls are protected by Orca runtime guardrails, or when secrets were captured from a Pi prompt.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Orca-rs - High-performance Rust hook for Claude Code that blocks dangerous commands before execution. SIMD-accelerated, modular pack system, whitelist-first architecture. Essential safety layer for agent workflows.
Pragmatic Zig abstraction-design workflow for coding agents. Use when designing, reviewing, simplifying, or refactoring Zig APIs that use comptime generics, type-returning functions, structural duck typing, error unions, optionals, tagged unions, function pointers, vtables, interface-like structs, allocator or IO dependencies, public contracts, test seams, or Zig 0.15/0.16 abstraction and std.Io migration tradeoffs.
Production Zig engineering guidance for coding agents. Use when writing, reviewing, debugging, refactoring, testing, packaging, or migrating Zig code, especially around allocator ownership, error handling, std library version drift, build.zig/build.zig.zon, cross-compilation, C interop, performance, safety, security, and Zig 0.15/0.16-era patterns as of 2026-05-13.
Zig build-system and package-management workflow for coding agents. Use when creating, reviewing, debugging, or migrating build.zig, build.zig.zon, package dependencies, build steps, check/test/fuzz/bench steps, generated files, install artifacts, release archives, cross-target builds, CI build matrices, local package overrides, Zig package fingerprints, or Zig 0.15/0.16 build API drift.
Current Zig ecosystem and tooling gap assessment workflow for coding agents as of 2026-05-13. Use when evaluating Zig adoption risk, dependency hygiene, package management, ZLS/editor behavior, compiler or stdlib regressions, pre-1.0 API churn, cross-platform support tiers, unofficial package indexes, toolchain pinning, CI matrices, or mitigation plans for Zig 0.15/0.16-era ecosystem gaps.
Zig memory-safety review and implementation workflow for coding agents. Use when writing, reviewing, debugging, or refactoring Zig code that touches allocators, ownership, lifetimes, slices, pointers, arenas, unsafe casts, parser buffers, FFI buffers, leak detection, double-free/use-after-free risks, safety-checked illegal behavior, ReleaseFast safety assumptions, or Zig 0.15/0.16 memory API drift.
| name | orca |
| description | Use when Pi bash/write/edit/read/discovery tool calls are protected by Orca runtime guardrails, or when secrets were captured from a Pi prompt. |
Orca evaluates Pi tools before they run:
| Tool | Path |
|---|---|
bash | daemon Evaluate (orca evaluate --json --stdin, source.host=pi) |
write / edit | Zig orca decide file with operation: write |
read | Zig orca decide file with operation: read |
grep / find / ls | Root preflight plus explicit approval; descendants are not individually evaluated |
| Any other tool name (custom / MCP-shaped) | Zig orca decide tool with {"name":"<toolName>"} (name only) |
Custom/MCP-shaped tools are name-gated via decide tool — this is not full MCP protocol mediation or an MCP proxy. Treat an Orca block as a security decision, not as a formatting problem to route around.
grep, find, and ls remain approval-gated even when the root preflight allows them. Do not describe a broad root check as proof that every traversed file is safe.
Process-level env/network/secretless are not provided by the extension alone. Launch Pi under Orca:
orca run -- pi
orca run --secretless --network ask -- pi
Install: pi install npm:@orca-sec/pi-orca. Do not mix that with pi install ./orca-pi.
When Orca blocks a command or file action:
rule …)./orca-doctor for setup or daemon issues (output includes coverage).ORCA_PI_MODE=auto (interactive ask; noninteractive block). Does not silently fail open.ORCA_PI_MODE=strict or /orca-mode strict (strict also disables "Run once anyway" unless ORCA_PI_ALLOW_ONCE=true).orca.audit event (event: orca_once_bypass); if the host cannot record it, Orca keeps the action blocked. Set ORCA_PI_ALLOW_ONCE=false to remove the option entirely.allow-with-warning is never the default.If the user pastes an API key or other secret into chat, the Orca Pi extension may intercept the input, ask for consent, store the value under .orca/dev-secrets.env, and rewrite the prompt to reference $ENV_NAME instead of the raw secret.
When you see a rewritten prompt that mentions $OPENAI_API_KEY, $ANTHROPIC_API_KEY, $GITHUB_TOKEN, or similar:
orca run --secretless -- pi …).If capture is blocked in noninteractive mode, tell the user to re-run in interactive Pi or to set the env var outside chat.
If Orca is unavailable, prefer repair first: run /orca-setup, then /orca-doctor. /orca-setup only ensures the workspace policy and probes health; it never installs plugins for other hosts. The daemon starts automatically on the first protected shell evaluation.