momentic-mobile@1.34.1
The official CLI for Momentic Mobile. Build, run, and manage end-to-end tests for iOS and Android through natural language prompts.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiAgent skill and MCP setup is real but guarded: it runs only from explicit CLI commands or a TTY confirm, and package.json has no install lifecycle hook. That is first-party user-invoked agent configuration, so it is a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.
Trigger
Running momentic-mobile skills, momentic-mobile install-mcp, or answering yes to the skill prompt during run, test, or app on a TTY.
Impact
Consenting users get Momentic instructions and an MCP server definition in their coding-agent config. This does not run on npm install and does not silently rewrite unrelated agent settings.
Mechanism
The CLI copies bundled skill files into agent skill directories and merges an MCP server record into the selected project or user agent config. Non-TTY skill prompting returns without writing.
AI rationale
Agent skill and MCP setup is real but guarded: it runs only from explicit CLI commands or a TTY confirm, and package.json has no install lifecycle hook. That is first-party user-invoked agent configuration, so it is a warning rather than a publish block.
Evidence
bin/cli.js.claude/skillsCLAUDE.md.cursor/skills.cursor/mcp.json.github/skillsAGENTS.md~/.momentic/skills.json
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes only the momentic-mobile bin and has no npm preinstall, install, or postinstall scripts.
- The skills command, also aliased install-skills, is an explicit CLI action that writes Momentic skill files and instruction pointers into detected coding-agent directories.
- On run, test, and app, a TTY-only confirm prompt can install or update those same project skill files; non-interactive runs return before writing.
- install-mcp is a separate explicit command that merges a Momentic MCP server entry into the chosen agent config.
- The flagged .claude string is one directory name in a glob ignore list, not an install-time write.
Evidence against
- Skill and MCP writes are behind named commands or an interactive confirm, and they skip when stdin or stdout is not a TTY or MOMENTIC_SKIP_SKILLS_PROMPT is set.
- No lifecycle hook, self-dependency, hidden payload fetch, or credential export to an unrelated host was found in the inspected entrypoints.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
11 flaggedbin/cli.jsView file
31import { PostHog } from 'posthog-node';
L32: import * as X7e from 'child_process';
L33: import { execFile, execSync, execFileSync, exec } from 'child_process';
High
178L179: What the agent did: ${r}`:e}var ev=ua.extend({type:z.literal("AI_ACTION_DYNAMIC"),text:z.string(),effort:st.optional(),retries:z.number().optional(),version:QS.optional(),cache:AD....
L180: `).map((r,n)=>n>0?`${o}${r}`:r).join(`
...
L182: `).map((d,p)=>p>0?` ${d}`:d).join(`
L183: `)),i(" ",o(m));}}setMinLevel(e){typeof e=="string"?this.minLogLevel=pv[e]:this.minLogLevel=e;}setOutputStream(e){this.forcedStream=e;}log(...e){this.logWithLevel(30,ms.reset,...e...
L184: `)){let[r,n]=o.trim().split(/\s+/,2);if(!r||!n)continue;let i=Number.parseInt(n,10);Number.isFinite(i)&&(e[r]=i);}return e}function z0e(t,e){let o,r,n;for(let i of e.split(`
L185: `)){let a=i.indexOf(":");if(a===-1)continue;let s=i.slice(0,a),l=i.slice(a+1).trim();if(s==="Name"&&(o=l),s==="PPid"&&(r=Number.parseIn
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L178•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/cli.js:
import Bo__default, { statSync, readFileSync, existsSync, readdir, readdirSync, mkdirSync, writeFileSync, rmSync, appendFileSync, watch, unlinkSync, renameSync } from 'fs';
import hYe from 'readline';
import { createInterface } from 'node:readline';
import wN, { mkdtemp, writeFile, rm as rm$1, stat, readFile, readdir as readdir$1, mkdir, unlink } from 'fs/promises';
`)),i(" ",o(m));}}setMinLevel(e){typeof e=="string"?this.minLogLevel=pv[e]:this.minLogLevel=e;}setOutputStream(e){this.forcedStream=e;}log(...e){this.logWithLevel(30,ms.reset,...e...
`)}var HZ=["0-mail.com","0-mailer.dynv6.net","000-webmail.myhome-server.de","0
Findings
9 High4 Medium7 Low
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
HighTrigger Reachable External Post Callbackbin/cli.js
HighSemantic Analysis Limitedbin/cli.js
MediumDynamic Requirebin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
Affected versions and remediation
This report applies to momentic-mobile@1.34.1.
See all versions of momentic-mobile for other recorded verdicts.
- Review the evidence and your use of momentic-mobile@1.34.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.