momentic-mobile@1.35.0
The official CLI for Momentic Mobile. Build, run, and manage end-to-end tests for iOS and Android through natural language prompts.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package contains an explicit coding-agent configuration command with an opt-in credential-writing path. It lacks an inspected lifecycle hook or evidence of covert exfiltration, so blocking is not supported.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the install-mcp command, optionally selecting clients, scope, and API-key inclusion.
Impact
A user-approved agent configuration can gain access to the Momentic MCP server. No confirmed covert attack surface was established.
Mechanism
The command chooses agent configuration targets and writes an MCP server entry; saved API-key inclusion is separately gated.
AI rationale
The package contains an explicit coding-agent configuration command with an opt-in credential-writing path. It lacks an inspected lifecycle hook or evidence of covert exfiltration, so blocking is not supported.
Evidence
bin/cli.js
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package exposes a command-line executable rather than an install lifecycle hook.
- The explicit install-mcp command is intended to add a Momentic MCP server to coding-agent configuration.
- The setup routine selects clients and writes an MCP entry to their project or user configuration.
- Writing an existing API key into that configuration requires an explicit option.
Evidence against
- No package lifecycle script was declared in the inspected manifest.
- No hidden credential export or unrelated network recipient was identified in the inspected setup path.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
11 flaggedbin/cli.jsView file
31import { PostHog } from 'posthog-node';
L32: import * as iXe from 'child_process';
L33: import { execFile, execSync, execFileSync, exec } from 'child_process';
High
178L179: What the agent did: ${r}`:e}var tv=ua.extend({type:z.literal("AI_ACTION_DYNAMIC"),text:z.string(),effort:st.optional(),retries:z.number().optional(),version:ev.optional(),cache:RD....
L180: `).map((r,n)=>n>0?`${o}${r}`:r).join(`
...
L182: `).map((d,p)=>p>0?` ${d}`:d).join(`
L183: `)),i(" ",o(m));}}setMinLevel(e){typeof e=="string"?this.minLogLevel=fv[e]:this.minLogLevel=e;}setOutputStream(e){this.forcedStream=e;}log(...e){this.logWithLevel(30,ms.reset,...e...
L184: `)){let[r,n]=o.trim().split(/\s+/,2);if(!r||!n)continue;let i=Number.parseInt(n,10);Number.isFinite(i)&&(e[r]=i);}return e}function G0e(t,e){let o,r,n;for(let i of e.split(`
L185: `)){let a=i.indexOf(":");if(a===-1)continue;let s=i.slice(0,a),l=i.slice(a+1).trim();if(s==="Name"&&(o=l),s==="PPid"&&(r=Number.parseIn
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L178•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/cli.js:
import Bo__default, { statSync, readFileSync, existsSync, readdir, readdirSync, mkdirSync, writeFileSync, rmSync, appendFileSync, watch, unlinkSync, renameSync } from 'fs';
import CYe from 'readline';
import { createInterface } from 'node:readline';
import TN, { mkdtemp, writeFile, rm as rm$1, stat, readFile, readdir as readdir$1, mkdir, unlink } from 'fs/promises';
`)),i(" ",o(m));}}setMinLevel(e){typeof e=="string"?this.minLogLevel=fv[e]:this.minLogLevel=e;}setOutputStream(e){this.forcedStream=e;}log(...e){this.logWithLevel(30,ms.reset,...e...
`)}var WZ=["0-mail.com","0-mailer.dynv6.net","000-webmail.myhome-server.de","0
Findings
9 High4 Medium7 Low
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
HighTrigger Reachable External Post Callbackbin/cli.js
HighSemantic Analysis Limitedbin/cli.js
MediumDynamic Requirebin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
Affected versions and remediation
This report applies to momentic-mobile@1.35.0.
See all versions of momentic-mobile for other recorded verdicts.
- Review the evidence and your use of momentic-mobile@1.35.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.