The Agent Skills Directory

[DATA_EXFILTRATION]: The helper script scripts/wbso contains extensive logic to harvest local interaction and development data.
It accesses sensitive interaction logs from Claude and Codex located in ~/.claude/projects/ and ~/.codex/sessions/, extracting user prompts to send to the vendor's API.
It collects local repository history via git log --all to use as compliance signals.
While the specific whoami command used in this skill primarily reads account info, the accompanying script provided in the skill payload enables broad harvesting of user activity.
[COMMAND_EXECUTION]: The skill uses a dynamic discovery mechanism to execute code.
In SKILL.md, it performs a recursive search using find across numerous directories (including $PWD and several agent-specific skill paths) to locate the wbso executable and then executes it.
This pattern of execution based on files found in potentially attacker-writable directories (like $PWD) represents a risk of executing unintended scripts.
[EXTERNAL_DOWNLOADS]: The CLI script performs numerous network operations to portal.wbso.ai.
It sends data via curl for user registration, authentication, context synchronization, and activity logging.
All communication is directed to the vendor's infrastructure using an API key stored in ~/.config/wbso/config.
[CREDENTIALS_UNSAFE]: The skill manages authentication tokens by writing them to ~/.config/wbso/config.
The implementation follows safety best practices by using umask 077 and chmod 600 to restrict file access to the current user.

wbso-whoami