wbso-auth

The code appears to implement the advertised WBSO compliance CLI, but it has a high-impact command-injection vulnerability because parse_args evaluates command-line-derived text with eval. It also executes local configuration files and exposes potentially sensitive Claude/Codex prompts and Git data through compliance context output. No clear malware, credential-stealing backdoor, or obfuscated payload is present; the primary risks are unsafe shell evaluation, trust in mutable configuration, configurable credential destination, and sensitive-data disclosure.