@momentic/wizard@1.0.4
Onboarding wizard for setting up Momentic end-to-end testing in your project.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is an explicit-user-command AI-agent configuration capability, not an install-time malicious chain. Its automatic non-interactive selection of detected agent control surfaces warrants a warning under policy.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs momentic-wizard, including non-interactively.
Impact
Adds a Momentic MCP command to selected local agent configurations and installs Momentic tooling.
Mechanism
MCP registration plus CLI/skills installation
AI rationale
This is an explicit-user-command AI-agent configuration capability, not an install-time malicious chain. Its automatic non-interactive selection of detected agent control surfaces warrants a warning under policy.
Evidence
package.jsonREADME.mdbin/cli.js~/.config/Claude/claude_desktop_config.json~/.codeium/windsurf/mcp_config.json~/.config/opencode/opencode.json~/.gemini/config/mcp_config.json
Network endpoints2
api.momentic.aip.momentic.ai
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- bin/cli.js writes Momentic MCP entries into detected agent config files.
- Non-interactive runs default to detected agents plus skills.
- CLI invokes package-manager commands to install Momentic CLIs and skills.
- CLI posts onboarding metadata to the configured Momentic API with the supplied API key.
Evidence against
- package.json has no install lifecycle scripts.
- README.md describes the behavior as an explicitly invoked onboarding wizard.
- No eval, Function, remote-payload execution, or decoded-code execution was found.
- Agent config writes are scoped to a named Momentic MCP entry and occur from the wizard command.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
7 flaggedbin/cli.jsView file
153L154: `),testStats:c,testDebugTrace:l,moduleRestoreResults:u}}function tk({entries:e,orgId:t,testId:o,logger:n}){let r=new Map,a;for(let s of e)if(s.entity_type==="test")a=bb.parse({orgI...
L155: `)||e.includes("\r")||e.includes("{{")||e.includes("}}")||e.length===0||!e.toLowerCase().endsWith(".json"))}function re(e){return Object.fromEntries(Object.entries(e).filter(([,t])...
...
L157: ${r.map(a=>a.configFilePath)}`);if(r.length===0)throw new Error("No valid Momentic project file available.");return yt.debug(`Found valid project configuration at ${r[0].configFile...
L158: `)){let r=n.indexOf("=");if(r===-1)continue;let a=n.slice(0,r),s=n.slice(r+1).trim();o[a]=s;}return o}async function sZ(e,t,o){try{let r=o["github.user"]||void 0;if(r)return r}catc...
L159:
...
L161: ${Se.cyan(s)
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
bin/cli.jsView on unpkg · L153148Trigger-reachable chain: manifest.bin -> bin/cli.js
L148: `));}function ld(e){let{debugLines:t,debugLabel:o,currentSteps:n,currentIndex:r,reason:a}=e;t.push([cc(o,`mint fresh step for current[${r}]`),`reason=${a}`,`currentStep=${Zo(n[r])}...
L149: `));}function cc(e,t){return `[${e}] ${t}`}function Zo(e){return JSON.stringify(e)??"undefined"}function qo(e){return e.toFixed(3)}var lc=class{debugLines=[];adapter;context;curren...
L150: `)),s.length===0)return [];if(c.length===0)return s.map(m=>this.adapter.mintFreshStep({currentStep:m,context:this.context}));let l=Array.from({length:s.length}),u=this.getExactUniq...
...
L157: ${r.map(a=>a.configFilePath)}`);if(r.length===0)throw new Error("No valid Momentic project file available.");return yt.debug(`Found valid project configuration at ${r[0
Findings
2 Critical6 High3 Medium5 Low
CriticalRemote Asset Decode Executebin/cli.js
CriticalTrigger Reachable Dangerous Capabilitybin/cli.js
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Low
Affected versions and remediation
This report applies to @momentic/wizard@1.0.4.
See all versions of @momentic/wizard for other recorded verdicts.
- Review the evidence and your use of @momentic/wizard@1.0.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.