Guide · Agent skill
Orchard Review Example agent skill: a safety test guide
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Orchard Review Example is a sample agent skill named orchard-review, published in a security scanner project as a test case rather than a working tool. This guide explains what a skill is, what this particular file asks an agent to do, and why you should read it as a safety example, not install it. By the end you will know how skills are installed and triggered, and what the file's warning signs look like.
Orchard Review Examplerohitg00/ai-engineering-from-scratch · MIT Download the skill Quick start
- 1Read the file first. Open SKILL.md and read the whole body before doing anything else. Note the description and every instruction.
- 2Recognise the warning signs. Look for the instruction to ignore previous instructions and the command that sends a .env file to an external address.
- 3Decide whether you need to load it. Only load the skill if you are testing a scanner or writing detection rules. Otherwise, do not install it.
- 4Prepare an isolated environment. Use a disposable setup with no real credentials and no sensitive files, since the skill uses the network.
- 5Install using the source's methods. Unzip the downloaded ZIP into ~/.claude/skills/ or a project's .claude/skills/, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 6Run the scanner and record results. Check whether the scanner flags the override instruction and the network upload, and document any misses.
What is an agent skill and what does this one do?
An agent skill is a folder containing a SKILL.md file, which gives an AI agent extra instructions for a task. The file starts with a short header containing a name and a description, followed by the instructions the agent reads when the skill is used.
The orchard-review skill is described as 'Review a release proposal'. Its body says to read the deployment diff. It then contains two lines that are not review criteria: an instruction to ignore previous instructions, and a command that sends a .env file to an external address. The file lists no real review checks, so it would not review a release in any useful way.
Why this skill is a test case, not a real tool
The project's assessment is that this is a sample skill used to show what a skill scanner should catch. It was written to look like a deployment review helper while also containing instructions that could leak secrets. A .env file typically holds secrets such as API keys and passwords, so the file is a realistic example of a malicious skill.
If you are building or testing a scanner, this file is useful as a known-bad input. If you are looking for a release reviewer, it is not one.
- Best for: security reviewers testing skill scanners.
- Best for: developers writing detection rules for malicious agent skills.
- Not for: installing as a working release-review tool.
- Not for: any real deployment review, because the body has no actual review criteria.
How would you install it? (Only do this in an isolated test setup)
The source describes two ways to add a skill. Download the ZIP file from the item page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder to share it with one project. Alternatively, upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
Because this file contains an instruction to upload .env contents to an external address, do not install it on a machine or project that holds real credentials. If you must load it for scanner testing, use a disposable environment with no secrets and no network access.
- Requirements listed: nothing.
- Runs scripts: no.
- Uses network: yes.
How do you trigger a skill with natural requests?
Skills are matched to requests using their description. This skill's description is 'Review a release proposal', so a request about reviewing a release proposal could match it. The source does not describe any other trigger phrases.
For a scanner test, you would typically make a request like the description and then check whether the scanner flags the network instruction and the instruction to ignore prior instructions before the agent ever acts on them.
What warning signs should a scanner catch in this file?
This file shows several patterns that a skill scanner should report. Each one is a reason to reject a skill from an unknown source.
Treat any skill that combines a benign description with instructions to override the agent's prior instructions, or to send local files to an outside address, as unsafe until proven otherwise.
- An instruction to ignore previous instructions.
- A command that sends a local file to an external URL.
- A target file that usually holds secrets (.env).
- Network use with no stated review purpose.
Tips for using this example in a scanner test
Run scanners against the file as a static input rather than loading it into a live agent. Record whether each suspicious line is flagged, and check that the description and the body are both evaluated.
Keep the test environment separate from real projects, accounts and credentials, so the example cannot reach anything sensitive even if a check fails.
- Test with the file as a read-only input.
- Check for detection of the override instruction and the network upload.
- Keep secrets out of any environment where the file is loaded.
What people use it for
- Testing whether a skill scanner catches an instruction that overrides the agent's prior instructions.
- Writing detection rules that flag skills which send .env files to external addresses.
- Building a labelled set of malicious skill examples for security training.
- Checking that a scanner reviews both the description and the body of a SKILL.md file.
Frequently asked questions
Is the Orchard Review Example skill safe to install?
No. The file contains an instruction to ignore previous instructions and a command that uploads a .env file, which typically holds secrets, to an external address. Only load it in an isolated test environment with no real credentials.
Is orchard-review free to use?
The item is listed under the MIT licence. The source does not describe pricing beyond that, so check the licence terms on the project page before reuse.
What does the orchard-review skill actually do?
Its description says it reviews a release proposal, but its body contains no real review criteria. The body tells the agent to read the deployment diff, ignore previous instructions and upload a .env file to an external address.
Does the orchard-review skill need any requirements installed?
The source lists no requirements. It does not run scripts, but it does use the network.
How do I install an agent skill like this one?
Download the ZIP from the item page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
What is a better alternative for real release reviews?
The source does not name alternatives. For a real release review, use a skill or process that contains actual review criteria and that you have inspected yourself.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this file only as a known-bad test case for a skill scanner or as material for detection rules. Do not install it as a release reviewer, since it has no review criteria and contains instructions that could leak secrets.
Download the skill