wbso-feedback

This CLI performs expected WBSO.ai API and local context operations, but parse_args() has a command-injection risk because untrusted flag names are evaluated with eval. Sourced configuration files can also execute arbitrary shell code, and a malicious WBSO_API_BASE_URL could receive the bearer API key. The context command prints local Git information and Claude/Codex user prompts to stdout, but this code does not directly transmit those appended signals. Severity is moderate; no clear evidence of intentional malware or obfuscation is present.