@momentic/wizard@1.1.3
Onboarding wizard for setting up Momentic end-to-end testing in your project.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a real user-invoked agent-extension capability with broad local configuration effects, so it warrants a warning. Source inspection does not support the scanner's malicious remote-decode-and-execute claim or a publish block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs `momentic-wizard`, then selects or accepts coding-agent/skills setup.
Impact
Adds a local agent extension that later runs Momentic through npx.
Mechanism
Optional MCP configuration mutation and global skills CLI invocation.
AI rationale
This is a real user-invoked agent-extension capability with broad local configuration effects, so it warrants a warning. Source inspection does not support the scanner's malicious remote-decode-and-execute claim or a publish block.
Evidence
package.jsonREADME.mdbin/cli.jsmomentic.config.yaml~/.momentic/auth.json~/.config/opencode/opencode.json~/.config/Claude/claude_desktop_config.json~/.codeium/windsurf/mcp_config.json~/.gemini/config/mcp_config.json
Network endpoints4
api.momentic.aiapi.workos.comp.momentic.airegistry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- bin/cli.js optionally writes Momentic MCP entries into agent config files.
- The wizard invokes `npx ... skills@latest add momentic-ai/skills --global`.
- It executes requested package-manager/CLI commands in the chosen project.
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hook.
- Agent wiring is reached only by running the wizard and is presented as a selectable setup step.
- No remote payload is decoded and executed; Buffer base64 use builds a Cursor deeplink.
- Network calls are Momentic/WorkOS auth, telemetry, update, and onboarding endpoints.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
7 flaggedbin/cli.jsView file
151L152: `),testStats:c,testDebugTrace:u,moduleRestoreResults:l}}function sL({entries:e,orgId:t,testId:o,logger:i}){let r=new Map,a;for(let s of e)if(s.entity_type==="test")a=Jb.parse({orgI...
L153: `)||e.includes("\r")||e.includes("{{")||e.includes("}}")||e.length===0||!e.toLowerCase().endsWith(".json"))}function re(e){return Object.fromEntries(Object.entries(e).filter(([,t])...
...
L155: ${r.map(a=>a.configFilePath).join(`
L156: `)}`);if(r.length===0)throw new Y(`No valid Momentic project file (${Qe}) was found in the current directory or any parent directory. Run this command from inside your Momentic pro...
L157: `);if(a===-1)continue;let s=r.slice(0,a),c=r.slice(a+1).trim();i[s]=c;}return i}function Lc(e){if(e.startsWith("git@")){let t=e.split(":");if(t.length===2){let o=t[1].repl
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
bin/cli.jsView on unpkg · L151152Trigger-reachable chain: manifest.bin -> bin/cli.js
L152: `),testStats:c,testDebugTrace:u,moduleRestoreResults:l}}function sL({entries:e,orgId:t,testId:o,logger:i}){let r=new Map,a;for(let s of e)if(s.entity_type==="test")a=Jb.parse({orgI...
L153: `)||e.includes("\r")||e.includes("{{")||e.includes("}}")||e.length===0||!e.toLowerCase().endsWith(".json"))}function re(e){return Object.fromEntries(Object.entries(e).filter(([,t])...
L154: ${n.prettifyError(c)}`:`: ${ge(c)}`;Je.warn(`Project config at ${e} does not match the required schema${u}`);return}let i=Od(t,o),r=KL(i,"").filter(c=>!GL.some(u=>c===`ai.${u}`));r...
L155: ${r.map(a=>a.configFilePath).join(`
L156: `)}`);if(r.length===0)throw new Y(`No valid Momentic project file (${Qe}) was found in the current directory or any parent directo
Findings
2 Critical6 High3 Medium5 Low
CriticalRemote Asset Decode Executebin/cli.js
CriticalTrigger Reachable Dangerous Capabilitybin/cli.js
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Low
Affected versions and remediation
This report applies to @momentic/wizard@1.1.3.
See all versions of @momentic/wizard for other recorded verdicts.
- Review the evidence and your use of @momentic/wizard@1.1.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.