The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/wbso file contains a shell injection vulnerability in the parse_args function, which uses eval on unsanitized command-line argument values (e.g., --flag "$(id)").
[DATA_EXFILTRATION]: The CLI tool collects local environment signals including git commit history (git log) and user prompts from Claude (~/.claude/projects/) and Codex (~/.codex/sessions/) logs, and transmits this data to the vendor's API (portal.wbso.ai).
[INDIRECT_PROMPT_INJECTION]: The skill displays markdown content fetched from a remote API, creating a vulnerability surface where the remote server could provide malicious instructions to the agent.
Ingestion points: scripts/wbso fetches content from portal.wbso.ai/api/v1/compliance/context.md.
Boundary markers: The script does not wrap the fetched content in delimiters or include instructions for the agent to ignore embedded commands.
Capability inventory: The skill can execute shell commands (rm, curl, git, python3), access specific local files, and perform network requests.
Sanitization: No sanitization is performed on the markdown content before it is passed to the agent.
[DYNAMIC_EXECUTION]: The script uses python3 to dynamically process session logs at runtime using piped heredoc scripts.
[COMMAND_EXECUTION]: The SKILL.md file executes a targeted command (rm -f) to remove its own local configuration file (~/.config/wbso/config) upon user logout.

wbso-logout