wbso-signup

SUSPICIOUS: the workflow mostly matches the stated purpose of WBSO account signup and onboarding, and data appears intended for WBSO.ai. The main concern is trust in the bundled/local `wbso` executable that handles PII, stores an API key, and drives subsequent authenticated actions without clear public package provenance in the skill itself.

The code appears to implement the advertised WBSO compliance CLI, but it has a high-impact command-injection vulnerability because parse_args evaluates command-line-derived text with eval. It also executes local configuration files and exposes potentially sensitive Claude/Codex prompts and Git data through compliance context output. No clear malware, credential-stealing backdoor, or obfuscated payload is present; the primary risks are unsafe shell evaluation, trust in mutable configuration, configurable credential destination, and sensitive-data disclosure.