Research assistance with an evidence trail
WAL-0.1 is an experimental agent and tool workflow for WordPress plugin security research. It combines model-assisted analysis with a controlled investigation process. It is not presented as a newly trained foundation model.
From candidate to reviewed finding
- Intake — identify the plugin, version, authorized scope, and research environment.
- Inspect — examine entry points, permissions, data flow, and candidate weaknesses.
- Validate — attempt reproducible tests in an isolated environment.
- Review — have a researcher assess evidence, impact, and alternative explanations.
- Report — document what was observed and distinguish hypotheses from confirmed findings.
What the first alpha contains
The latest alpha package goes beyond the earlier proposed Scout and Deep roles. Its CLI, provider configuration, session memory, and reporting structure were inspired by Agentic-Bug-Hunter, with a WordPress-specific research workflow.
| Component | Alpha capability |
|---|---|
| Plugin intake | Imports a plugin folder or ZIP and preserves source hashes |
| Reconnaissance | Maps WordPress registrations and sensitive operations |
| Local investigation | Lets a configured local model read relevant files and investigate candidates |
| Selected escalation | Passes explicitly selected leads to a configured API model |
| Research memory | Saves candidates, model reviews, decisions, and evidence |
| Verification lab | Generates Docker configuration with paired WordPress user accounts |
| Reporting | Separates provisional leads from human-confirmed findings |
These describe the previously prepared alpha package. The agent source is separate from this portfolio website.
Run the existing alpha
If you have the previously generated WAL-0.1 package, its documented offline starting point is:
cd wal-0.1
npm run demo
npm test
Configure your installed local model in the package’s config/providers.json, following its README. These are alpha-package commands, not website build commands.
Validation and limits
The original alpha delivery reported 22 passing tests and a successful offline demonstration. Those are package checks, not a benchmark of vulnerability detection accuracy. Live model inference and Docker startup still needed validation on the target machine.
The initial scanner identifies textual patterns. It does not perform full PHP data-flow analysis, and reproduction remains manual. A pattern match or model-generated explanation remains a hypothesis until a researcher validates the behavior.
What should an investigation preserve?
Keep the exact plugin version and source hash, relevant files, account roles, environment, reproduction steps, observed results, and the reviewer’s decision. Record rejected and inconclusive leads alongside confirmed results.
Next development milestones
- Add PHP call-path analysis and compare it with the textual baseline.
- Make lab verification repeatable across vulnerable and patched examples.
- Evaluate false positives and missed findings using a reviewed reference set.
- Validate provider configuration and Docker startup in the target environment.
Current stage
The WAL-0.1 web workspace imports PHP files or ZIP archives, preserves a source-bundle hash, produces textual review leads, saves reviewer decisions, exports reports and local lab configuration, and creates linked WAL Research reports. Source is stored privately and never executed on the website.
Live model review requires a configured provider. Until one is connected, source triage and manual review work independently. The web workspace is a new implementation based on the documented workflow; the earlier alpha’s reported 22 tests do not validate this web release.