The Agent Skills Directory

[COMMAND_EXECUTION]: The parse_args function in the wbso script uses the eval command to dynamically set variables based on command-line arguments. This allows for arbitrary shell command execution if an attacker can control the key of a flag passed to the script (e.g., --key;command;=value).- [DATA_EXFILTRATION]: The scripts/wbso file contains routines to collect sensitive information from the local environment, including git commit logs and interaction history from Claude and Codex sessions, which are sent to the remote compliance API.- [DYNAMIC_EXECUTION]: The script uses eval for runtime variable assignment based on external input string components, which is a dangerous coding pattern that bypasses standard shell safety mechanisms.- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from a remote API which determines the displayed account and project information.
Ingestion points: Remote response from portal.wbso.ai in cmd_whoami.
Boundary markers: None; the script uses regex to parse specific fields from a markdown response.
Capability inventory: The skill has the ability to execute shell commands and perform network operations.
Sanitization: No sanitization is performed on the data received from the API before it is processed by the agent.

wbso-whoami