The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/wbso helper script contains a command injection vulnerability in its argument parsing logic. The parse_args function uses eval to assign command-line arguments to internal variables without sanitizing the input. If an attacker manages to pass a crafted argument (e.g., via indirect prompt injection or user manipulation), they can execute arbitrary shell commands in the agent's environment.
[DATA_EXFILTRATION]: The skill's context command automatically collects sensitive information from the local environment to provide "compliance context." This includes git commit logs (git log) and conversation histories from other agent sessions stored in ~/.claude/projects/ and ~/.codex/sessions/. This harvested data is presented to the agent context and can be transmitted to the vendor's API at portal.wbso.ai via the feedback or evidence subcommands.
[EXTERNAL_DOWNLOADS]: The skill performs multiple network operations using curl to communicate with portal.wbso.ai. It fetches compliance data, validates API keys, and submits activity logs. These operations are consistent with the skill's stated purpose for the WBSO.ai vendor.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from multiple sources—including git commit messages and historical LLM session logs—and surfaces them directly into the agent's current conversation context. These ingested logs are wrapped in XML tags (e.g., <claude_user_prompts_today>) but lack sufficient sanitization or instruction to the agent to ignore potentially malicious commands embedded within that data.

wbso-auth