registry / wienerdog / 0.3.0

wienerdog@0.3.0

Give your AI a memory, habits, and a daily routine — with nothing but files. One-line setup for Claude Code and Codex CLI.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious attack surface. The main risk is explicit user-command setup of first-party AI-agent hooks, skills, scheduler jobs, and optional Google integrations.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs wienerdog init, sync, schedule, dream, run-job, or gws commands.

Impact

Could extend Claude/Codex behavior after user setup and trust, but source shows package-aligned local automation rather than exfiltration or stealth persistence.

Mechanism

First-party CLI installs local memory/hooks/scheduler integrations and optional OAuth Google Workspace client.

Rationale

Static inspection found broad local integration capabilities, but they are explicit CLI behavior with no npm lifecycle hook, stealth install, credential exfiltration, remote payload execution, or destructive action. Because it sets up first-party AI-agent hooks/skills and scheduler entries after user commands, warn rather than block.

Evidence

package.jsonbin/wienerdog.jssrc/cli/init.jssrc/cli/sync.jssrc/adapters/codex.jssrc/adapters/shared.jssrc/cli/schedule.jssrc/cli/run-job.jssrc/core/update-check.jssrc/gws/auth.jssrc/gws/client.js~/.wienerdog/config.yaml~/.wienerdog/state/digest.md~/.wienerdog/skills/~/.wienerdog/bin/session-start.sh~/.wienerdog/bin/codex-session-end.sh~/.claude/CLAUDE.md~/.claude/settings.json~/.codex/AGENTS.md~/.codex/hooks.json~/.agents/skills/~/Library/LaunchAgents/ai.wienerdog.*.plist~/.config/systemd/user/wienerdog-*.timer~/.config/systemd/user/wienerdog-*.service

Network endpoints6

registry.npmjs.org/-/package/wienerdog/dist-tagswww.googleapis.com/auth/gmail.readonlywww.googleapis.com/auth/gmail.composewww.googleapis.com/auth/calendarwww.googleapis.com/auth/drive.readonly127.0.0.1:<ephemeral>/

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

User-invoked sync/init writes Claude/Codex managed blocks, hooks, and skill links in src/cli/sync.js and src/adapters/*.js.
src/adapters/codex.js registers SessionStart/Stop command hooks in ~/.codex/hooks.json, requiring Codex trust via /hooks.
src/cli/schedule.js and src/scheduler/generators.js create launchd/systemd scheduler entries for user-added jobs.
src/core/update-check.js performs bounded opt-out npm registry update check.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks.
AI-agent config mutation is via explicit CLI commands, package-namespaced skills/hooks, and manifest tracking, not install-time stealth.
Hook scripts are copied from templates/hooks and used for local session digest behavior; no remote payload loading found.
Google Workspace access is explicit OAuth/user command with stored local tokens and Google API scopes, not credential harvesting.
Child process use is package-aligned: git vault setup, scheduler registration, claude/codex job execution with bounded env/watchdogs.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 268 KB of source, external domains: 127.0.0.1, github.com, registry.npmjs.org, www.apple.com, www.googleapis.com

Source & flagged code

4 flagged

src/core/vault.jsView file

Lines 1-26javascript

1'use strict';

3const fs = require('node:fs');

4const os = require('node:os');

5const path = require('node:path');

6const crypto = require('node:crypto');

7const { execFileSync, spawnSync } = require('node:child_process');

8const { WienerdogError } = require('./errors');

9const manifestLib = require('./manifest');

11const TEMPLATE_ROOT = path.join(__dirname, '..', '..', 'templates', 'vault');

13/** @returns {string} today's date as YYYY-MM-DD, or WIENERDOG_FAKE_TODAY if set. */

14function today() {

15 if (process.env.WIENERDOG_FAKE_TODAY) return process.env.WIENERDOG_FAKE_TODAY;

16 return new Date().toISOString().slice(0, 10);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/vault.jsView on unpkg · L6

17}

19/** @param {string[]} args @param {string} cwd @returns {boolean} true if git exited 0. */

20function gitOk(args, cwd) {

21 const result = spawnSync('git', args, { cwd });

22 return !result.error && result.status === 0;

23}

25/** @throws {WienerdogError} if git is not installed. */

26function assertGitInstalled() {

src/scheduler/generators.jsView file

Lines 1-24javascript

1'use strict';

3const fs = require('node:fs');

4const path = require('node:path');

5const { spawnSync } = require('node:child_process');

templates/hooks/codex-session-end.shView file

•path = templates/hooks/codex-session-end.sh kind = build_helper sizeBytes = 944 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/hooks/codex-session-end.shView on unpkg

src/cli/run-job.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = wienerdog@0.1.0 matchedIdentity = npm:d2llbmVyZG9n:0.1.0 similarity = 0.643 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/run-job.jsView on unpkg

Source & flagged code

4 flagged · loading source

src/core/vault.jsView file

6const crypto = require('node:crypto'); L7: const { execFileSync, spawnSync } = require('node:child_process'); L8: const { WienerdogError } = require('./errors'); ... L10: L11: const TEMPLATE_ROOT = path.join(__dirname, '..', '..', 'templates', 'vault'); L12: ... L14: function today() { L15: if (process.env.WIENERDOG_FAKE_TODAY) return process.env.WIENERDOG_FAKE_TODAY; L16: return new Date().toISOString().slice(0, 10);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/vault.jsView on unpkg · L6

src/scheduler/generators.jsView file

4const path = require('node:path'); L5: const { spawnSync } = require('node:child_process'); L6: ... L222: // must never spawn the real scheduler. Injected loaders are unaffected. L223: if (process.env.WIENERDOG_LOADER_NOOP) return { status: 0 }; L224: const r = spawnSync(argv[0], argv.slice(1)); ... L240: function ensureCatchup(paths, opts = {}) { L241: if (process.platform !== 'darwin') return { changed: false }; L242: const loader = opts.loader || defaultCatchupLoader; ... L247: const plistPath = path.join(launchAgentsDir(paths.home), `${label}.plist`); L248: const unload = ['launchctl', 'bootout', `gui/${uid}/${label}`]; L249:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/scheduler/generators.jsView on unpkg · L4

templates/hooks/codex-session-end.shView file

•path = templates/hooks/codex-session-end.sh kind = build_helper sizeBytes = 944 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/hooks/codex-session-end.shView on unpkg

src/cli/run-job.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/run-job.jsView on unpkg

Findings

1 High5 Medium5 Low

HighPrevious Version Dangerous Deltasrc/cli/run-job.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/scheduler/generators.js

MediumShips Build Helpertemplates/hooks/codex-session-end.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/core/vault.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/core/vault.jsView file

Lines 1-26javascript

1'use strict';

3const fs = require('node:fs');

4const os = require('node:os');

5const path = require('node:path');

6const crypto = require('node:crypto');

7const { execFileSync, spawnSync } = require('node:child_process');

8const { WienerdogError } = require('./errors');

9const manifestLib = require('./manifest');

11const TEMPLATE_ROOT = path.join(__dirname, '..', '..', 'templates', 'vault');

13/** @returns {string} today's date as YYYY-MM-DD, or WIENERDOG_FAKE_TODAY if set. */

14function today() {

15 if (process.env.WIENERDOG_FAKE_TODAY) return process.env.WIENERDOG_FAKE_TODAY;

16 return new Date().toISOString().slice(0, 10);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/vault.jsView on unpkg · L6

17}

19/** @param {string[]} args @param {string} cwd @returns {boolean} true if git exited 0. */

20function gitOk(args, cwd) {

21 const result = spawnSync('git', args, { cwd });

22 return !result.error && result.status === 0;

23}

25/** @throws {WienerdogError} if git is not installed. */

26function assertGitInstalled() {

src/scheduler/generators.jsView file

Lines 1-24javascript

1'use strict';

3const fs = require('node:fs');

4const path = require('node:path');

5const { spawnSync } = require('node:child_process');

templates/hooks/codex-session-end.shView file

•path = templates/hooks/codex-session-end.sh kind = build_helper sizeBytes = 944 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/hooks/codex-session-end.shView on unpkg

src/cli/run-job.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/run-job.jsView on unpkg