The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/wbso utility uses the eval command to parse CLI arguments in the parse_args function (lines 125 and 129). This is vulnerable to command injection if malicious characters are passed as flag keys (e.g., executing the script with a flag like --$(whoami)=val), which could lead to arbitrary shell command execution.
[DATA_EXPOSURE]: The script reads sensitive private data from ~/.claude/projects/ and ~/.codex/sessions/ to extract context about the user's work day. While this aligns with the skill's stated purpose of tracking research and development hours, it involves processing and potentially exposing full conversation histories to the agent context.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from git log and agent session history files. This data is used to synthesize hour-booking proposals, creating a surface for injection attacks.
Ingestion points: Git commit messages, Claude session logs, and Codex session logs are read into the agent's context in the append_local_signals function.
Boundary markers: The skill uses XML tags such as <git_commits_today> and <claude_user_prompts_today>, but these provide only structural delimitation and do not prevent the model from following instructions contained within the logs.
Capability inventory: The agent can execute the wbso shell script, modify configuration files, and perform network POST requests to the vendor's API.
Sanitization: No sanitization or filtering of the ingested log content was observed before it is presented to the AI model.
[COMMAND_EXECUTION]: The SKILL.md instructions guide the agent to locate and execute the wbso CLI wrapper using a complex find command that searches multiple directories, including $PWD and hidden skill caches. This dynamic path resolution could be manipulated to execute unauthorized local scripts if they are placed in searched locations.

wbso