The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/wbso utility script contains a shell injection vulnerability in its argument parsing logic.
The parse_args function uses the eval command to dynamically create variables from command-line flags without performing sanitization.
This allows for the execution of arbitrary shell commands if malicious command substitution patterns (e.g., $(command)) are included in flag names.
[DATA_EXFILTRATION]: The skill incorporates functions that harvest sensitive local information from the user's development environment.
The script reads local git logs and extracts user prompt history from session files associated with Claude and Codex (~/.claude/projects/ and ~/.codex/sessions/).
This aggregated data is sent to the portal.wbso.ai domain as part of the platform's compliance tracking functionality.
[DYNAMIC_EXECUTION]: The implementation relies on dynamic code generation and execution to process data.
The helper script frequently pipes dynamically constructed code blocks into the Python interpreter to handle JSON parsing and text extraction tasks.

wbso-feedback