registry / wookledger / 0.2.0

wookledger@0.2.0

Durable, verified, crash-proof state for AI coding agents. The wook CLI: autonomous, drift-checked builds on your own model key.

AI Security Review

scanned 6h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `wook setup`, `wook gate --install`, `wook build/run/plan/watch`, or related CLI commands.

Impact

Can install a Claude Code Stop hook, persist local Wook config/state, send prompts/license metadata to configured services, and write project files during requested build workflows.

Mechanism

Explicit-user-command AI agent setup, model-driven project edits, license/model/network calls, and optional notifications.

Rationale

The risky primitives are real but are activated by explicit CLI commands and align with the advertised AI coding-agent workflow. Because it mutates an AI-agent control surface only through user-command setup and no concrete exfiltration or stealth execution chain is present, warn rather than block.

Evidence

package.jsonREADME.mddist/wook.mjs~/.wook/config.json~/.wook/device.json~/.wook/notify.json~/.wook/projects.json.claude/settings.json.wook-demo/ledger.jsonl.wook-demo/manifest.jsonbuild-root files named by agent/task plan

Network endpoints4

engine.wookvisory.comapi.anthropic.comntfy.sh/user-configured Slack/webhook endpoints

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/wook.mjs has explicit `wook setup` and `wook gate --install` paths that write `.claude/settings.json` Stop hook config.
dist/wook.mjs writes and reads persistent user state under `~/.wook` and build state such as ledgers/manifests.
dist/wook.mjs sends license/device data to `https://engine.wookvisory.com` and model prompts to `https://api.anthropic.com` when user invokes CLI workflows.
dist/wook.mjs can run user/task verification commands via child_process and can write model-produced edits into project files.

Evidence against

package.json defines only a `bin` entry and no preinstall/install/postinstall lifecycle scripts.
AI-agent control-surface mutation is tied to explicit user commands (`setup` or `gate --install`), not install-time execution.
Network use is package-aligned for license/engine, Anthropic model calls using user's key, and user-configured notifications.
No source evidence of credential harvesting, stealth persistence, remote payload download/execution, or destructive behavior outside CLI build workflows.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 140 KB of source, external domains: 127.0.0.1, api.anthropic.com, engine.wookvisory.com, hooks.slack.com, wookledger.com, www.w3.org, x.example

Source & flagged code

2 flagged

dist/wook.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{request as qt,createServer as Yt}from"node:http";import{request as Qt}from"node:https";import{spawnSync as st,spawn as Xt}from"node:child_process";import{createHash as Zt,randomUUID as en}from"node:crypto";import{mkdirSync as W,writeFileSync as A,readFileSync as P,appendFileSync as tn,existsSync as y,rmSync as Z,readdirSync as nn,statSync as on,renameSync as sn,chmodSync as rt}from"node:fs";import{join as k,relative as rn,resolve as le,extname as an,basename as ve,dirname as ln,isAbsolute as cn,sep as Ot}from"node:path";import{homedir as te}from"node:os";import*as Et from"node:readline/ ...

3`)}catch{}return o}var at=_t();function Nt(){let e=process.env.WOOK_SEAT_NAME?.trim();return e&&e.length?e:at}var N=process.env.WOOK_DEMO_ROOT??k(process.cwd(),".wook-demo"),dn=k(N,"build"),Ao=k(N,"ledger.jsonl"),Qe=k(N,"manifest.json"),Ct=Number(process.env.WOOK_ITEMS??10),wt=Number(process.env.WOOK_STEP_MS??600),L=Array.from({length:Ct},(e,t)=>`module-${String(t+1).padStart(2,"0")}`);process.stdout.on("error",e=>{e.code==="EPIPE"&&process.exit(0)});function Xe(e){return new Promise(t=>setTimeout(t,e))}function T(e){return Zt("sha256").update(e).digest("hex")}function Re(e){let t=e instanceof ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/wook.mjsView on unpkg · L1

4`)}async function vn(e){try{let t=await be();return t.valid||(console.error(`wook build: license ${t.reason??"not valid"}. the build loop runs on a valid license. run 'wook license' for detail.`),process.exit(1)),mn(e,t),t}catch{let t=He(e),n=yt(t,T(Ie),Date.now

5`).filter(s=>s.trim()!==""),o=[];for(let s=0;s<n.length;s++)try{o.push(JSON.parse(n[s]))}catch{if(s===n.length-1)break;throw new Error(`ledger corrupt at line ${s+1}`)}return o}function E(e,t=N){e=JSON.parse(JSON.stringify(e));let n=C(t),o="",s=0,i=null;if(y(n)){let l=P(n,"utf8").split(`

6`).filter(m=>m.trim()!==""),p=[];for(let m=0;m<l.length;m++)try{JSON.parse(l[m]),p.push(l[m])}catch{if(m===l.length-1)i=p.slice();else throw new Error(`ledger corrupt at line ${m+1}`)}if(s=p.length,p.length>0)try{o=JSON.parse(p[p.length-1])._sig??""}catch{o=""}}let r=T(o+we(e)),a={...e,_seq:s,_prev:o,_sig:r};i!==null&&K(n,i.length?i.join(`

7`)+`

8`:""),tn(n,JSON.stringify(a)+`

9`)}function V(e=N){let t=q(e);return y(t)?De(P(t,"utf8"),"manifest",t):{}}function ce(e,t=N){K(q(t),JSON.stringify(e,null,2))}function

10`),v=[],d=Math.max(m.length,a.lineHashes.length);for(let g=0;g<d;g++){let $=m[g]??"";(a.lineHashes[g]===void 0||T($)!==a.lineHashes[g])&&v.push({n:g+1,current:$})}s.push({file:r,kind:"changed",lines:v})}let i=T("control-original")!==T("control-TAMPERED");return{ok:s.length===0,controlCaught:i,drift:s}}function yn(e){return`// ${e}

11// sealed by the wook loop

12export const id = "${e}";

13`}var Ze=class{name="mock";async doUnit(t){return{content:yn(t)}}async doTask(t,n){let o=n.nowUtc??new Date().toISOString();if(t.files&&t.files.length>0){let i=t.files.map(r=>({path:r,content:`// ${r}

14// task ${t.id}: ${t.goal}

15// sealed by the wook task loop at ${o}

16export const task = "${t.id}";

17`}));return{edits:i,note:`mock task ${t.id} touched ${i.length} file(s)`}}let s=`src/${t.id}`;return{edits:[{path:`${s}.ts`,content:`// ${s}.ts

18// task ${t.id}: ${t.goal}

19export const ${t.id.replace(/[^a-zA-Z0-9_]/g,"_")} = () => "${t.id}";

20`},{path:`${s}.test.ts`,content:`// ${s}.test.ts

21// covers task ${t.id}

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

dist/wook.mjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/wook.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import{request as qt,createServer as Yt}from"node:http";import{request as Qt}from"node:https";import{spawnSync as st,spawn as Xt}from"node:child_process";import{createHash as Zt,ra... L3: `)}catch{}return o}var at=_t();function Nt(){let e=process.env.WOOK_SEAT_NAME?.trim();return e&&e.length?e:at}var N=process.env.WOOK_DEMO_ROOT??k(process.cwd(),".wook-demo"),dn=k(N... L4: `)}async function vn(e){try{let t=await be();return t.valid||(console.error(`wook build: license ${t.reason??"not valid"}. the build loop runs on a valid license. run 'wook license...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/wook.mjsView on unpkg · L1

Findings

2 High2 Medium4 Low

HighSame File Env Network Executiondist/wook.mjs

HighCommand Output Exfiltrationdist/wook.mjs

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/wook.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/wook.mjsView on unpkg · L1

7`)+`

8`:""),tn(n,JSON.stringify(a)+`

9`)}function V(e=N){let t=q(e);return y(t)?De(P(t,"utf8"),"manifest",t):{}}function ce(e,t=N){K(q(t),JSON.stringify(e,null,2))}function

11// sealed by the wook loop

12export const id = "${e}";

14// task ${t.id}: ${t.goal}

15// sealed by the wook task loop at ${o}

16export const task = "${t.id}";

17`}));return{edits:i,note:`mock task ${t.id} touched ${i.length} file(s)`}}let s=`src/${t.id}`;return{edits:[{path:`${s}.ts`,content:`// ${s}.ts

18// task ${t.id}: ${t.goal}

19export const ${t.id.replace(/[^a-zA-Z0-9_]/g,"_")} = () => "${t.id}";

20`},{path:`${s}.test.ts`,content:`// ${s}.test.ts

21// covers task ${t.id}

Long lines were clipped for display.