@momentic/wizard@1.2.0
Onboarding wizard for setting up Momentic end-to-end testing in your project.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is not malicious install-time behavior, but it has a real explicit-command AI-agent configuration and global-skill installation capability. Warn so users can assess the selected editor integrations and remote package execution.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run `momentic-wizard`, including non-interactive execution where detected editor tools and skills are selected.
Impact
Can alter selected AI-agent MCP configuration and introduce third-party skill tooling; no unconsented install-time trigger is present.
Mechanism
Explicit CLI-driven agent configuration and package-manager subprocess execution
AI rationale
This is not malicious install-time behavior, but it has a real explicit-command AI-agent configuration and global-skill installation capability. Warn so users can assess the selected editor integrations and remote package execution.
Evidence
package.jsonbin/cli.jsREADME.mdmomentic.config.yaml~/.momentic/auth.json~/.codeium/windsurf/mcp_config.json~/.config/opencode/opencode.json
Network endpoints3
api.momentic.airegistry.npmjs.orgstatic.momentic.ai
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with low false-positive risk.
Evidence for warning
- bin/cli.js configures MCP entries for multiple external coding agents.
- Explicit wizard execution can run `npx skills@latest ... --global`.
- CLI accepts API key env/flag and sends authenticated requests to configured Momentic server.
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hook.
- All behavior is reached from the user-invoked CLI entrypoint.
- No remote payload decoding/execution found; atob/Function matches are bundled dependencies.
- Agent setup is presented as optional editor-tool configuration.
- Writes are scoped to Momentic project files, credential file, or selected agent configs.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
7 flaggedbin/cli.jsView file
155${r.map(a=>a.configFilePath).join(`
L156: `)}`);if(r.length===0)throw new Z(`No valid Momentic project file (${Qe}) was found in the current directory or any parent directory. Run this command from inside your Momentic pro...
L157: `);if(a===-1)continue;let s=r.slice(0,a),c=r.slice(a+1).trim();i[s]=c;}return i}function Nc(e){if(e.startsWith("git@")){let t=e.split(":");if(t.length===2){let o=t[1].replace(".git...
...
L170: ${r.code(Ck(d,i))}`,a),t)try{await f3(d);}catch{e.warn(`Could not open a browser automatically. Paste ${r.code(d)} manually.`);}let h=e.spinner();h.start(s);try{let g=await dN({cli...
L171: `))i&&console.info(`\u2502 ${i}`);},success(o){console.info(`\u2714 ${o}`);},error(o){console.info(`\u2716 ${o}`);}}}};var gN=new va({debug:false});function ee(){return gN}fun
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
bin/cli.jsView on unpkg · L155155Trigger-reachable chain: manifest.bin -> bin/cli.js
L155: ${r.map(a=>a.configFilePath).join(`
L156: `)}`);if(r.length===0)throw new Z(`No valid Momentic project file (${Qe}) was found in the current directory or any parent directory. Run this command from inside your Momentic pro...
L157: `);if(a===-1)continue;let s=r.slice(0,a),c=r.slice(a+1).trim();i[s]=c;}return i}function Nc(e){if(e.startsWith("git@")){let t=e.split(":");if(t.length===2){let o=t[1].replace(".git...
...
L170: ${r.code(Ck(d,i))}`,a),t)try{await f3(d);}catch{e.warn(`Could not open a browser automatically. Paste ${r.code(d)} manually.`);}let h=e.spinner();h.start(s);try{let g=await dN({cli...
L171: `))i&&console.info(`\u2502 ${i}`);},success(o){console.info(`\u2714 ${o}`);},error(o){console.info(`\u2716 ${o}`);}}}};var
Findings
2 Critical6 High3 Medium5 Low
CriticalRemote Asset Decode Executebin/cli.js
CriticalTrigger Reachable Dangerous Capabilitybin/cli.js
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Low
Affected versions and remediation
This report applies to @momentic/wizard@1.2.0.
See all versions of @momentic/wizard for other recorded verdicts.
- Review the evidence and your use of @momentic/wizard@1.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.