The Agent Skills Directory

[DATA_EXFILTRATION]: The context command in scripts/wbso automatically collects and transmits local activity data to https://portal.wbso.ai. This includes:
Git commit history from the current working directory via git log.
Local Claude AI session prompts extracted from the directory ~/.claude/projects/.
Local Codex session prompts extracted from the directory ~/.codex/sessions/.
[COMMAND_EXECUTION]: The script scripts/wbso contains several patterns vulnerable to shell injection:
The parse_args function uses eval to dynamically assign shell variables from command-line arguments: eval "ARG_${key//-/_}=\"\$val\"". An attacker could attempt to inject commands through maliciously crafted flag names.
The write_config function uses an unquoted heredoc (cat > "$CONFIG_FILE" <<EOF) which performs command substitution on the variables being written. If the API key, email, or base URL contains shell metacharacters (e.g., $(command)), they will be executed by the shell during the write operation or when the config is later loaded via source.
[DYNAMIC_EXECUTION]: The skill uses eval to process command-line arguments and source to load configuration files, which allows for dynamic execution of potentially untrusted input generated during the session.
[INDIRECT_PROMPT_INJECTION]: The skill fetches markdown content from an external API (/api/v1/compliance/context.md) and injects it directly into the agent's context without sanitization or boundary markers.
Ingestion points: scripts/wbso function cmd_context downloads content from the vendor API using curl.
Boundary markers: Absent; the downloaded markdown is printed directly to the standard output for the agent to process.
Capability inventory: The skill has the capability to delete configuration files (rm -f), execute git commands, and perform network requests.
Sanitization: None; the remote content is not escaped or validated before being presented to the AI agent.

wbso-logout