wbso
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local git commits and AI agent session history (Claude and Codex) to synthesize tracking suggestions. This creates a surface where malicious instructions embedded in those logs could influence the agent's behavior. Ingestion points include git log output and session files in ~/.claude/projects/ and ~/.codex/sessions/. While the data is wrapped in XML tags, no explicit sanitization or filtering of embedded instructions is performed.
- [DATA_EXFILTRATION]: The skill reads sensitive local activity logs (user prompts and git history) and transmits summarized information to the portal.wbso.ai domain. Although this domain is owned by the skill vendor, the capability involves transporting sensitive local data to an external server.
- [COMMAND_EXECUTION]: The skill directs the agent to execute a bundled shell script for API interaction. The resolution logic for finding this script searches multiple user-controlled directories, which could potentially lead to the execution of an unintended file if a naming collision occurs within the search paths.
Audit Metadata