registry / @momentic/wizard / 1.3.2
@momentic/wizard@1.3.2
Onboarding wizard for setting up Momentic end-to-end testing in your project.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection shows an explicit onboarding workflow with user-agent configuration and remote service authentication, but no malicious install-time or concealed attack chain. Warn because noninteractive defaults can modify detected agent integrations and install global skills.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the momentic-wizard CLI; agent wiring is selected interactively or defaulted for detected agents in noninteractive mode.
Impact
Adds a Momentic npx command to selected agent configuration and installs first-party skills; it also uses the provided API key with the configured Momentic service.
Mechanism
User-invoked agent configuration and global skills installation.
AI rationale
Source inspection shows an explicit onboarding workflow with user-agent configuration and remote service authentication, but no malicious install-time or concealed attack chain. Warn because noninteractive defaults can modify detected agent integrations and install global skills.
Evidence
package.jsonbin/cli.jsREADME.md~/.config/Claude/claude_desktop_config.json~/.config/opencode/opencode.json~/.codeium/windsurf/mcp_config.json~/.gemini/config/mcp_config.json
Network endpoints3
api.momentic.aiapi.workos.comp.momentic.ai
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The invoked wizard can wire a Momentic MCP command into coding-agent and editor configuration.
- Noninteractive runs select detected agents and Momentic skills by default and install the skills package globally.
- The CLI sends a supplied API key to its configured Momentic server for authentication and onboarding.
Evidence against
- package.json has no preinstall, install, postinstall, or other lifecycle script.
- The agent setup is part of an explicit user-run onboarding CLI and is presented as a selectable prompt.
- The Base64 use creates a Cursor deeplink configuration; no decoded remote payload is executed.
- No credential harvesting, arbitrary command execution, destructive action, or hidden persistence was confirmed.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
8 flaggedbin/cli.jsView file
155${o.map(a=>a.configFilePath).join(`
L156: `)}`);if(o.length===0)throw new Z(`No valid Momentic project file (${ot}) was found in the current directory or any parent directory. Run this command from inside your Momentic pro...
L157: `);if(a===-1)continue;let s=o.slice(0,a),c=o.slice(a+1).trim();i[s]=c;}return i}function qc(e){if(e.startsWith("git@")){let t=e.split(":");if(t.length===2){let r=t[1].replace(".git...
...
L170: ${o.code(ck(d,i))}`,a),t)try{await AX(d);}catch{e.warn(`Could not open a browser automatically. Paste ${o.code(d)} manually.`);}let h=e.spinner();h.start(s);try{let g=await r$({cli...
L171: `))i&&console.info(`\u2502 ${i}`);},success(r){console.info(`\u2714 ${r}`);},error(r){console.info(`\u2716 ${r}`);}}}};var a$=new Pa({debug:false});function oe(){return a$}fun
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
bin/cli.jsView on unpkg · L155155Trigger-reachable chain: manifest.bin -> bin/cli.js
L155: ${o.map(a=>a.configFilePath).join(`
L156: `)}`);if(o.length===0)throw new Z(`No valid Momentic project file (${ot}) was found in the current directory or any parent directory. Run this command from inside your Momentic pro...
L157: `);if(a===-1)continue;let s=o.slice(0,a),c=o.slice(a+1).trim();i[s]=c;}return i}function qc(e){if(e.startsWith("git@")){let t=e.split(":");if(t.length===2){let r=t[1].replace(".git...
...
L170: ${o.code(ck(d,i))}`,a),t)try{await AX(d);}catch{e.warn(`Could not open a browser automatically. Paste ${o.code(d)} manually.`);}let h=e.spinner();h.start(s);try{let g=await r$({cli...
L171: `))i&&console.info(`\u2502 ${i}`);},success(r){console.info(`\u2714 ${r}`);},error(r){console.info(`\u2716 ${r}`);}}}};var
Findings
2 Critical7 High3 Medium5 Low
CriticalRemote Asset Decode Executebin/cli.js
CriticalTrigger Reachable Dangerous Capabilitybin/cli.js
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @momentic/wizard@1.3.2.
See all versions of @momentic/wizard for other recorded verdicts.
- Review the evidence and your use of @momentic/wizard@1.3.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.