Why are windows files with the extension ".url" and ".wsh" considered dangerous (e.g. blocked by many mail filters)? The way I see it:
.URL: you can link to a malicious website which serves an exploit, but it is even easier to type said url in a mail message? You can link to a local file, but you can't pass any arguments to a local file. .WSH: you can link to a local script. A WSH file on itself can't do anything harmfull. You can't pass any argument to an existing script on the windows system.