Rook

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Rook describes itself as an agent that automates work across tabs, apps and files, and the code is consistent with that job. The network hits sit in worker files and build chunks: NET-SOCKET_IO-background.js-54, NET-FETCH-assets/sqlite3-worker1-C4QEEqpT.js-36 and NET-FETCH-chunks/dictation-DJiaI1G6.js-31 are library-level detections for socket.io and fetch, not evidence of a covert channel. The endpoint list is the useful part. anthropic.com, api.cerebras.ai, api.deepseek.com, api.fireworks.ai and api.clay.com are model-provider and CRM APIs. An assistant that can route a prompt to five different providers has to talk to five different hosts, and those are the hosts.

The same list also contains a large amount of text that is not a domain at all: ad.creditcard, aes.new, add.menu, agent.cc, a-date.now, 00value.int, 3a123.md. These are property chains and string fragments the extractor lifted out of minified JavaScript. They resolve to nothing and match no service the extension claims to use. They are also why the indicator count reaches 3,384, and that count says more about the extractor than about the code.

The two high-severity signatures are both YARA--supply_chain_sourcemap_appended_iife, one in assets/delegated-run.worker-4CRJ8xfO.js:616 and one in assets/think-host.worker-C6wY548k.js:1396. That rule looks for live code placed after a sourcemap comment, which is how bundlers and some build plugins emit output. Neither hit names a payload, a remote host or a credential path. They describe the shape of the build output rather than behaviour.

The obfuscation findings map onto shipped third-party code. OBFUSCATION-LARGE_WASM_FILE lands on assets/esbuild.wasm, which is esbuild, a JavaScript bundler the extension vendors. OBFUSCATION-INVISIBLE_ZERO_WIDTH appears in chunks/less-BGJv5CZz.js and chunks/less-DVTAwKKz.js, the Less CSS compiler, where zero-width characters live in string tables. OBFUSCATION-EXCESSIVE_PRIVATE_USE_AREA in chunks/lib-CUif5TQz.js is the glyph map you find in bundled icon fonts. OBFUSCATION-UNICODE_HEAVY in chunks/sidepanel-Dp3Vi7g6.js:452 sits in the same family of bundled text data. None of these are payload hiding. The 1,641 code-smell hits scatter across hashed Vite chunks, which is what happens when hundreds of npm packages ship in one bundle.

A skeptic would push back on two points. First, assets/esbuild.wasm means the extension can compile and run JavaScript it generates, which is a real capability and the reason an agent like this deserves review rather than a free pass. Second, the sourcemap-appended-IIFE rule exists because malware does hide code that way, and two hits is two hits. What would move this verdict is a payload: a credential read, a remote script fetch, a second-stage domain. None of that appears. A manifest read would also help, because the captured permission list is empty and a single manifest-analysis finding is all we have on declared access. That gap is worth closing.

Key Reasons

• Network endpoints are AI provider and CRM APIs (api.cerebras.ai, api.deepseek.com, api.fireworks.ai, anthropic.com, api.clay.com), consistent with an agent that routes prompts to multiple models.
• Both malware-signature hits are the same bundler-pattern rule, YARA--supply_chain_sourcemap_appended_iife, on hashed worker chunks with no payload, domain or credential path attached.
• Obfuscation findings land on vendored third-party artifacts: assets/esbuild.wasm, chunks/less-BGJv5CZz.js, chunks/less-DVTAwKKz.js and chunks/lib-CUif5TQz.js.
• The 3,384 IoC hits include non-hostname fragments such as ad.creditcard, aes.new and agent.cc, so volume reflects extractor behaviour rather than code behaviour.
• Developer identity matches the product domain mcp-b.ai and the version is current, with no typosquatting against a known extension name.

False Positive Considerations

• IoU extractor garbage: ad.creditcard, aes.new, add.menu, a-date.now and 00value.int are minified-code fragments, not registrable domains
• code-smell volume (1,641) and IoC volume (3,384) generated by hundreds of bundled npm packages in hashed Vite chunks
• OBFUSCATION-INVISIBLE_ZERO_WIDTH and OBFUSCATION-EXCESSIVE_PRIVATE_USE_AREA firing on unicode tables in the bundled Less compiler and icon font glyph maps
• YARA--supply_chain_sourcemap_appended_iife matching standard bundler output that appends code after a sourcemap comment

Reviewed 2026-10-14; recommended action: suppress false positive; model confidence 78%.