registry / @momentic/wizard / 1.7.3
@momentic/wizard@1.7.3
Onboarding wizard for setting up Momentic end-to-end testing in your project.
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe flagged capabilities are part of an explicitly invoked Momentic onboarding CLI: its detected-agent setup adds a Momentic MCP entry, while its API defaults to the Momentic service. No install-time trigger or concrete malicious behavior was identified, so the static warnings do not establish an attack.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs `momentic-wizard` and chooses agent setup, or runs it non-interactively with agent setup enabled.
Impact
The selected agent can use Momentic’s MCP server; the inspected behavior does not establish credential theft or unconsented install-time mutation.
Mechanism
The wizard merges a `npx`-based Momentic MCP server entry into the selected agent configuration.
AI rationale
The flagged capabilities are part of an explicitly invoked Momentic onboarding CLI: its detected-agent setup adds a Momentic MCP entry, while its API defaults to the Momentic service. No install-time trigger or concrete malicious behavior was identified, so the static warnings do not establish an attack.
Evidence
bin/cli.js
Network endpoints1
api.momentic.ai
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes `bin/cli.js` as a command-line entrypoint and declares no install lifecycle hook.
- When the wizard runs, it offers detected coding agents and Momentic skills; non-interactive setup defaults to detected agents plus skills.
- The selected agent setup writes an MCP server configuration that launches Momentic through `npx`.
- The CLI defaults to Momentic’s API server and accepts `MOMENTIC_SERVER` as an advanced override; the reviewed setup is an explicitly invoked wizard.
Evidence against
- The inspected behavior is guarded by running the wizard and selecting agent setup; no npm install hook triggers it.
- The agent configuration adds a Momentic MCP entry, and the credential flow targets the configured Momentic server.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
6 flaggedbin/cli.jsView file
21import G9 from 'open';
L22: import { spawn, spawnSync, execFileSync } from 'child_process';
L23: import { getUserAgent, detect, resolveCommand } from 'package-manager-detector';
High
205`)?l:`${l}
L206: `}function k9(e,t){let n=Te.join(Te.dirname(e),`.${Te.basename(e)}.${process.pid}.tmp`),r=So__default.existsSync(e)?So__default.statSync(e).mode:void 0;try{So__default.writeFileSyn...
L207: This usually means your machine or network intercepts HTTPS traffic (corporate proxy, firewall, or antivirus).
...
L220: `))r&&console.info(`\u2502 ${r}`);},success(n){console.info(`\u2714 ${n}`);},error(n){console.info(`\u2716 ${n}`);}}}};var GD=new qa({debug:false});function Q(){return GD}functi...
L221: `;So__default.writeSync(this.handle,n);}catch{}}close(){if(this.handle!==void 0)try{So__default.closeSync(this.handle);}catch{}}},YD=new rf("",void 0);function JD(){let e=Te.join(r...
L222: ${g}`,code:"ETIMEDOUT",tailOutput:g});kt().append({event:"spawn:timeout",command:e.com
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L205•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/cli.js:
`)),a(" ",n(m));}}setMinLevel(t){typeof t=="string"?this.minLogLevel=wM[t]:this.minLogLevel=t;}setOutputStream(t){this.forcedStream=t;}log(...t){this.logWithLevel(30,pe.reset,...t...
`)||e.includes("\r")||e.includes("{{")||e.includes("}}")||e.length===0||!e.toLowerCase().endsWith(".json"))}function ne(e){return Object.fromEntries(Object.entries(e).filter(([,t])...
`);function yr(e,t,{commentBefore:n,comment:r}){let o=e.items.find(a=>Gt.isPair(a)&&Gt.isScalar(a.key)&&a.key.value===t);if(o&&(n!==void 0&&Gt.isScalar(o.key)&&(o.key.commentBefore...
`);if(a===-1)continue;let s=o.slice(0,a),c=o.slice(a+1).trim();r[s]=c;}return r
Findings
7 High3 Medium5 Low
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @momentic/wizard@1.7.3.
See all versions of @momentic/wizard for other recorded verdicts.
- Review the evidence and your use of @momentic/wizard@1.7.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.