The Agent Skills Directory

[COMMAND_EXECUTION]: The parse_args function in scripts/wbso uses eval to process command-line arguments (e.g., eval "ARG_${key//-/_}=\"\$val\""). This logic is vulnerable to command injection if a flag key or value contains shell metacharacters like command substitutions or semicolons.
[COMMAND_EXECUTION]: The script uses the source command to load its configuration file at ~/.config/wbso/config. This file is populated with data retrieved from the WBSO.ai API. If the API response contains malicious shell commands, they will be executed on the user's system when the configuration is loaded.
[DATA_EXFILTRATION]: The skill programmatically collects and exposes sensitive user data to the agent, including Git commit logs and prompt histories from Claude Code (~/.claude/projects/) and Codex (~/.codex/sessions/). This data is intended for WBSO compliance but involves significant exposure of local activity.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from local history files into the agent's context.
Ingestion points: Git logs and JSONL session files in ~/.claude and ~/.codex directories.
Boundary markers: Data is delimited using XML-style tags such as <claude_user_prompts_today>.
Capability inventory: The skill possesses capabilities for network access (curl), file management (rm), and shell execution (eval).
Sanitization: Sanitization is limited to filtering specific command prefixes in session logs and does not include robust filtering of the actual prompt content.
[SAFE]: The skill interacts with the official vendor domain (portal.wbso.ai) to perform its primary business logic.

wbso-logout