The Agent Skills Directory

[COMMAND_EXECUTION]: The bundled CLI tool (scripts/wbso) uses the eval command to parse arguments without sufficient sanitization. Malicious input passed to flags like --first-name or --company-name can execute arbitrary bash commands. The skill also executes git log and searches through sensitive local directories (~/.claude/projects/, ~/.codex/sessions/) to gather activity context.
[DATA_EXFILTRATION]: The skill transmits time-tracking data, evidence descriptions, and project suggestions to portal.wbso.ai. This is the official API endpoint for the vendor (wbso-ai) and is required for the skill's primary functionality.
[PROMPT_INJECTION]: The skill ingests untrusted content from local Git commits and previous agent prompts, creating an indirect prompt injection surface. It uses XML tags (e.g., <git_commits_today>) to help the agent distinguish this data from its core instructions.
Ingestion points: scripts/wbso reads local development history and AI session logs.
Boundary markers: XML tags are employed to delimit external signals.
Capability inventory: Subprocess execution, local filesystem writes for configuration, and network requests to the vendor's API.
Sanitization: Basic message extraction is handled via Python, but it lacks robust defenses against malicious prompt content embedded within the ingested data.

wbso