@momentic/wizard@1.4.1
Onboarding wizard for setting up Momentic end-to-end testing in your project.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malware or an install-hook attack: there is no lifecycle hook or self-dependency. It does provide a real, user-triggered capability to modify agent configuration and install global skills, so it warrants a warning under the extension policy.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs momentic-wizard, especially non-interactively with detected agents or editor-tool selection.
Impact
The configured agent may later run the registered Momentic MCP command; the wizard also makes authenticated onboarding requests.
Mechanism
Agent configuration writes and child-process invocation for Momentic setup.
AI rationale
This is not malware or an install-hook attack: there is no lifecycle hook or self-dependency. It does provide a real, user-triggered capability to modify agent configuration and install global skills, so it warrants a warning under the extension policy.
Evidence
bin/cli.jsmomentic.config.yaml~/.config/Claude/claude_desktop_config.json~/.config/opencode/opencode.json~/.gemini/config/mcp_config.json
Network endpoints3
api.momentic.aiapi.workos.comp.momentic.ai
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The user-invoked wizard can configure detected coding agents and install Momentic skills, including in non-interactive mode.
- It imports child-process APIs used to run package-manager and agent CLI commands.
- It sends onboarding data with the supplied Momentic API key to the configured Momentic server.
Evidence against
- package.json exposes only a bin entry and has no lifecycle scripts.
- No self-dependency, obfuscated payload loading, or install-time execution was found.
- The network hosts are Momentic/WorkOS services used by the onboarding flow, not a hidden fixed gateway.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
6 flaggedbin/cli.jsView file
21import BX from 'open';
L22: import { spawn, execFileSync, spawnSync } from 'child_process';
L23: import { detect, getUserAgent, resolveCommand } from 'package-manager-detector';
High
157`),ZJ=[" Run tests on Momentic hosted browsers instead of local Chromium."," Use this in CI to run tests in parallel without adding machines. See https://momentic.ai/docs/running-t...
L158: `);function dn(e,t,{commentBefore:r,comment:i}){let o=e.items.find(a=>Dt.isPair(a)&&Dt.isScalar(a.key)&&a.key.value===t);if(o&&(r!==void 0&&Dt.isScalar(o.key)&&(o.key.commentBefore...
L159: `);if(a===-1)continue;let s=o.slice(0,a),c=o.slice(a+1).trim();i[s]=c;}return i}function Yc(e){if(e.startsWith("git@")){let t=e.split(":");if(t.length===2){let r=t[1].replace(".git...
...
L172: ${o.code(hN(d,i))}`,a),t)try{await BX(d);}catch{e.warn(`Could not open a browser automatically. Paste ${o.code(d)} manually.`);}let h=e.spinner();h.start(s);try{let g=await p$({cli...
L173: `))i&&console.info(`\u2502 ${
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L157•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/cli.js:
`)),a(" ",r(h));}}setMinLevel(t){typeof t=="string"?this.minLogLevel=II[t]:this.minLogLevel=t;}setOutputStream(t){this.forcedStream=t;}log(...t){this.logWithLevel(30,le.reset,...t...
`)||e.includes("\r")||e.includes("{{")||e.includes("}}")||e.length===0||!e.toLowerCase().endsWith(".json"))}function ee(e){return Object.fromEntries(Object.entries(e).filter(([,t])...
`);function dn(e,t,{commentBefore:r,comment:i}){let o=e.items.find(a=>Dt.isPair(a)&&Dt.isScalar(a.key)&&a.key.value===t);if(o&&(r!==void 0&&Dt.isScalar(o.key)&&(o.key.commentBefore...
`);if(a===-1)continue;let s=o.slice(0,a),c=o.slice(a+1).trim();i[s]=c;}return i
Findings
7 High3 Medium5 Low
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @momentic/wizard@1.4.1.
See all versions of @momentic/wizard for other recorded verdicts.
- Review the evidence and your use of @momentic/wizard@1.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.