momentic-mobile@1.33.1
The official CLI for Momentic Mobile. Build, run, and manage end-to-end tests for iOS and Android through natural language prompts.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiAgent instruction and MCP config changes are real, but they are first-party setup behind explicit CLI commands, with no install lifecycle hook. That is a user-invoked agent control change, so the package should be warned rather than blocked.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs momentic-mobile skills, momentic-mobile install-mcp, or momentic-mobile init with the skills option.
Impact
The selected local coding agent loads Momentic skills and can start the Momentic MCP server. npm install does not perform these writes.
Mechanism
The command writes an always-on Momentic skill pointer into the selected agent instruction file and can add an MCP config entry whose command is npx momentic-mobile mcp.
AI rationale
Agent instruction and MCP config changes are real, but they are first-party setup behind explicit CLI commands, with no install lifecycle hook. That is a user-invoked agent control change, so the package should be warned rather than blocked.
Evidence
bin/cli.js.claude/skillsCLAUDE.md
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes the momentic-mobile CLI through bin and has no npm lifecycle scripts.
- The install-mcp command writes a coding-agent MCP server entry that launches this CLI.
- Skill setup writes an always-on agent instruction pointer with alwaysApply set to true.
- The skills command installs Momentic skills and that pointer when the user runs it.
- Project init can install those same coding-agent skills through the --skills option.
Evidence against
- There is no preinstall, install, or postinstall script.
- Agent file writes are behind explicit CLI commands rather than package import or npm install.
- The published dependency list does not depend on momentic-mobile itself.
- API calls use the Momentic API key against the Momentic server for the test CLI.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
12 flaggedbin/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = momentic-mobile@1.33.0
matchedIdentity = npm:bW9tZW50aWMtbW9iaWxl:1.33.0
similarity = 0.909
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkg31import { PostHog } from 'posthog-node';
L32: import * as B7e from 'child_process';
L33: import { execFile, execSync, execFileSync, exec } from 'child_process';
High
178L179: What the agent did: ${r}`:e}var QS=ca.extend({type:z.literal("AI_ACTION_DYNAMIC"),text:z.string(),effort:st.optional(),retries:z.number().optional(),version:ZS.optional(),cache:CD....
L180: `).map((r,n)=>n>0?`${o}${r}`:r).join(`
...
L182: `).map((d,p)=>p>0?` ${d}`:d).join(`
L183: `)),i(" ",o(m));}}setMinLevel(e){typeof e=="string"?this.minLogLevel=dv[e]:this.minLogLevel=e;}setOutputStream(e){this.forcedStream=e;}log(...e){this.logWithLevel(30,ms.reset,...e...
L184: `)){let[r,n]=o.trim().split(/\s+/,2);if(!r||!n)continue;let i=Number.parseInt(n,10);Number.isFinite(i)&&(e[r]=i);}return e}function _0e(t,e){let o,r,n;for(let i of e.split(`
L185: `)){let a=i.indexOf(":");if(a===-1)continue;let s=i.slice(0,a),l=i.slice(a+1).trim();if(s==="Name"&&(o=l),s==="PPid"&&(r=Number.parseIn
Findings
1 Critical9 High4 Medium7 Low
CriticalPrevious Version Dangerous Deltabin/cli.js
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
HighTrigger Reachable External Post Callbackbin/cli.js
HighSemantic Analysis Limitedbin/cli.js
MediumDynamic Requirebin/cli.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to momentic-mobile@1.33.1.
See all versions of momentic-mobile for other recorded verdicts.
- Review the evidence and your use of momentic-mobile@1.33.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.