The Agent Skills Directory

[DATA_EXPOSURE]: The scripts/wbso wrapper script accesses sensitive local files to gather "compliance signals." It specifically targets AI agent session logs in ~/.claude/projects/ and ~/.codex/sessions/ to extract user prompt history.
Evidence: Functions append_claude_sessions_today and append_codex_sessions_today parse .jsonl files in agent metadata directories.
[DATA_EXFILTRATION]: Collected local data, including Git logs and the aforementioned AI session prompts, is transmitted to the vendor's API endpoint (portal.wbso.ai/api/v1/compliance/context.md). While this is a feature of the WBSO compliance platform, it involves the transmission of private prompt history to a remote server.
[COMMAND_EXECUTION]: The skill and its scripts execute several system commands to gather information and locate dependencies.
Evidence: Use of git log to extract commit history, and a broad find command in SKILL.md that scans multiple hidden agent directories (.claude, .cursor, .agents, .codex) to locate the CLI tool.
[DYNAMIC_EXECUTION]: The bash script uses python3 with heredocs and string-passed scripts to dynamically process JSON data and log files at runtime.
Evidence: cmd_track_time, cmd_evidence, and the session log appending functions all execute dynamically generated Python logic.
[CREDENTIALS_UNSAFE]: The script manages and accesses an API key stored in plain text on the local filesystem.
Evidence: Config is read from and written to ~/.config/wbso/config.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local logs and Git history directly into the agent's context, which could be used to influence agent behavior if those logs contain malicious instructions.
Ingestion points: ~/.claude/projects/*.jsonl, ~/.codex/sessions/*.jsonl, and git log.
Boundary markers: The logs are wrapped in XML-like tags (e.g., <claude_user_prompts_today>), but no explicit instructions are given to the agent to ignore instructions embedded within this data.
Capability inventory: The script can perform network requests (curl) and read/write files.
Sanitization: The script performs basic filtering (e.g., skipping assistant messages) but does not sanitize the text content of user prompts.

wbso-feedback