@momentic/wizard@1.7.1
Onboarding wizard for setting up Momentic end-to-end testing in your project.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a real explicit-user-command agent configuration capability and merits a warning, but source inspection found no install-time execution or concrete malicious behavior. The scanner's command-output and credential-redirection implications are not supported by the inspected flows.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs momentic-wizard and selects agent setup, or runs it non-interactively with matching editor settings.
Impact
A configured agent may later launch Momentic with the supplied API key; this changes agent capabilities in the selected project or user configuration.
Mechanism
Writes MCP configuration and invokes Momentic setup commands.
AI rationale
This is a real explicit-user-command agent configuration capability and merits a warning, but source inspection found no install-time execution or concrete malicious behavior. The scanner's command-output and credential-redirection implications are not supported by the inspected flows.
Evidence
bin/cli.js.codex/config.toml.mcp.json.cursor/mcp.json.vscode/mcp.jsonopencode.json
Network endpoints1
api.momentic.ai
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The user-invoked wizard writes MCP server entries into selected coding-agent configuration files and can include MOMENTIC_API_KEY in those entries.
- It sends an authenticated onboarding request to the configured Momentic server after setup.
- The package exposes a CLI launcher that can perform these actions when run.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Agent setup is reached through the wizard's interactive or non-interactive user command, not package installation.
- The observed network use is Momentic-aligned onboarding and API authentication; no hidden credential harvesting or command-output upload was confirmed.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetry
Source & flagged code
6 flaggedbin/cli.jsView file
21import R9 from 'open';
L22: import { spawn, spawnSync, execFileSync } from 'child_process';
L23: import { getUserAgent, detect, resolveCommand } from 'package-manager-detector';
High
205`)?u:`${u}
L206: `}function y9(e,t){let n=ve.join(ve.dirname(e),`.${ve.basename(e)}.${process.pid}.tmp`),r=mo__default.existsSync(e)?mo__default.statSync(e).mode:void 0;try{mo__default.writeFileSyn...
L207: This usually means your machine or network intercepts HTTPS traffic (corporate proxy, firewall, or antivirus).
...
L219: ${o.code(sz(p,r))}`,a),t)try{await R9(p);}catch{e.warn(`Could not open a browser automatically. Paste ${o.code(p)} manually.`);}let m=e.spinner();m.start(s);try{let f=await _D({cli...
L220: `))r&&console.info(`\u2502 ${r}`);},success(n){console.info(`\u2714 ${n}`);},error(n){console.info(`\u2716 ${n}`);}}}};var MD=new Fa({debug:false});function Q(){return MD}functi...
L221: `;mo__default.writeSync(this.handle,n);}catch{}}close(){if(this.handle!==void 0)try{mo
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L205•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/cli.js:
`)),a(" ",n(m));}}setMinLevel(t){typeof t=="string"?this.minLogLevel=yM[t]:this.minLogLevel=t;}setOutputStream(t){this.forcedStream=t;}log(...t){this.logWithLevel(30,ue.reset,...t...
`)||e.includes("\r")||e.includes("{{")||e.includes("}}")||e.length===0||!e.toLowerCase().endsWith(".json"))}function oe(e){return Object.fromEntries(Object.entries(e).filter(([,t])...
`);function dr(e,t,{commentBefore:n,comment:r}){let o=e.items.find(a=>jt.isPair(a)&&jt.isScalar(a.key)&&a.key.value===t);if(o&&(n!==void 0&&jt.isScalar(o.key)&&(o.key.commentBefore...
`);if(a===-1)continue;let s=o.slice(0,a),c=o.slice(a+1).trim();r[s]=c;}return r
Findings
7 High3 Medium5 Low
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @momentic/wizard@1.7.1.
See all versions of @momentic/wizard for other recorded verdicts.
- Review the evidence and your use of @momentic/wizard@1.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.