registry / @momentic/wizard / 1.3.1
@momentic/wizard@1.3.1
Onboarding wizard for setting up Momentic end-to-end testing in your project.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner’s remote-decode claim is unsupported by the inspected source. However, first-party agent-extension setup is a real capability and falls under the requested warn policy.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs momentic-wizard and selects or accepts coding-agent integration.
Impact
Adds a Momentic-controlled npx MCP command to supported agent clients; no covert execution or exfiltration chain was confirmed.
Mechanism
Agent MCP configuration mutation and global skills installation.
AI rationale
The scanner’s remote-decode claim is unsupported by the inspected source. However, first-party agent-extension setup is a real capability and falls under the requested warn policy.
Evidence
package.jsonbin/cli.jsREADME.md.momentic/auth.jsonmomentic.config.yaml.codeium/windsurf/mcp_config.json.config/Claude/claude_desktop_config.json.config/opencode/opencode.json.gemini/config/mcp_config.json
Network endpoints3
api.momentic.aip.momentic.aiapi.workos.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- User-invoked wizard can register a Momentic MCP server in detected coding-agent configurations.
- It writes/merges MCP settings for Claude Desktop, Windsurf, Opencode, and Antigravity, and invokes agent CLIs for other integrations.
- It globally installs Momentic skills through npx when selected/defaulted by its wizard flow.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- The only executable entrypoint is the user-invoked momentic-wizard CLI.
- Agent integration is presented as a wizard selection and is not install-time behavior.
- No remote payload download/decode/execute chain was found; base64 use creates a Cursor deeplink.
- Observed network use is Momentic API/onboarding, PostHog telemetry, and WorkOS device authentication.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
8 flaggedbin/cli.jsView file
155${o.map(a=>a.configFilePath).join(`
L156: `)}`);if(o.length===0)throw new Z(`No valid Momentic project file (${tt}) was found in the current directory or any parent directory. Run this command from inside your Momentic pro...
L157: `);if(a===-1)continue;let s=o.slice(0,a),c=o.slice(a+1).trim();i[s]=c;}return i}function Vc(e){if(e.startsWith("git@")){let t=e.split(":");if(t.length===2){let r=t[1].replace(".git...
...
L170: ${o.code(Zk(d,i))}`,a),t)try{await Z3(d);}catch{e.warn(`Could not open a browser automatically. Paste ${o.code(d)} manually.`);}let h=e.spinner();h.start(s);try{let g=await VN({cli...
L171: `))i&&console.info(`\u2502 ${i}`);},success(r){console.info(`\u2714 ${r}`);},error(r){console.info(`\u2716 ${r}`);}}}};var GN=new Ea({debug:false});function te(){return GN}fun
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
bin/cli.jsView on unpkg · L155155Trigger-reachable chain: manifest.bin -> bin/cli.js
L155: ${o.map(a=>a.configFilePath).join(`
L156: `)}`);if(o.length===0)throw new Z(`No valid Momentic project file (${tt}) was found in the current directory or any parent directory. Run this command from inside your Momentic pro...
L157: `);if(a===-1)continue;let s=o.slice(0,a),c=o.slice(a+1).trim();i[s]=c;}return i}function Vc(e){if(e.startsWith("git@")){let t=e.split(":");if(t.length===2){let r=t[1].replace(".git...
...
L170: ${o.code(Zk(d,i))}`,a),t)try{await Z3(d);}catch{e.warn(`Could not open a browser automatically. Paste ${o.code(d)} manually.`);}let h=e.spinner();h.start(s);try{let g=await VN({cli...
L171: `))i&&console.info(`\u2502 ${i}`);},success(r){console.info(`\u2714 ${r}`);},error(r){console.info(`\u2716 ${r}`);}}}};var
Findings
2 Critical7 High3 Medium5 Low
CriticalRemote Asset Decode Executebin/cli.js
CriticalTrigger Reachable Dangerous Capabilitybin/cli.js
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @momentic/wizard@1.3.1.
See all versions of @momentic/wizard for other recorded verdicts.
- Review the evidence and your use of @momentic/wizard@1.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.