momentic-mobile-test — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited momentic-mobile-test (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Momentic Mobile turns structured natural language into native and webview automation on Android emulators and iOS simulators. Interactive steps resolve targets into device actions; assertions can inspect screenshots, native hierarchies, and webview state.
Mobile tests use *.test.yaml; modules use *.module.yaml. Test IDs live in the test file's id field. Check momentic.config.yaml and test-level metadata before assuming project defaults apply.
fileType: momentic/mobile-test/v2 and fileType: momentic/mobile-module/v2 identify mobile v2. Treat missing or different fileType as deprecated v1. Never edit v1 YAML directly; persist changes through momentic_test_splice_steps.
Mobile v2 tests require platform: ANDROID or platform: IOS. Commands are platform-specific.
A mobile v2 test carries its own defaults: defaultEnv for environment variables, defaultChannel for the app channel, and defaultTag for a tag or an alias such as nightly. --env, --channel and --tag override them. defaultTag is optional: without it, the run installs the latest tag in the channel. In the local region the test installs defaultApkFilePath or defaultAppFilePath instead.
V2 can reference modules, JavaScript, and injected files with relative paths. Paths resolve from the YAML file containing the reference. Use ./... or ../..., never absolute paths or ~. Before moving, renaming, or deleting a referenced file, grep its path and update or remove every reference. File-backed JavaScript is v2-only; v1/MCP step strings carry code inline. Do not add internal or generated fields to v2 YAML.
Prefer these compact workflows unless the user requests something else:
or references are uncertain -> reload or restart if validating -> run the relevant range.
prerequisites -> preview a logical checkpoint -> splice it -> validate the saved range -> terminate.
momentic_test_create -> author a known v2 sequencein one YAML edit, or use MCP step-by-step when live discovery is needed. momentic_session_start only opens an existing test.
Use MCP as the default interactive interface. Preview and run wait 30 seconds by default, then return a stepRunnerId while work continues. Leave timeoutSeconds unset for most calls, especially single preset steps. Lower it only when the coding agent's tool timeout is shorter; raise it only within a larger tool timeout. Poll returned handles with momentic_poll_runner.
Prefer the test's configured remote device and app settings. Use local device or app overrides only when the user explicitly requests them.
Run npx momentic-mobile doctor for initial setup and launch, driver, device, or connectivity failures. Use --json when collecting a support report. See the doctor reference.
Remote Android requires adb and ANDROID_HOME; local Android also requires Java and Android Studio. Local iOS requires macOS and Xcode; remote iOS does not once a simulator build is available. Follow the Android or iOS setup guide rather than guessing at missing dependencies.
Android WebView automation requires a build with WebView debugging enabled. Debug builds usually provide it; release builds must enable it explicitly. Missing debugging commonly appears as No browser controller is attached to the requested webview. Mobile WebViews run through the device and do not need a local Chromium installation.
Confirm the goal, user-visible success criteria, platform, app source, provider, auth, and env requirements. Ask before previewing or running any step or AI action that may submit, purchase, delete, send, create, or cause another non-idempotent side effect. If approved, execute it at most once. Also ask before using local device overrides, editing a shared module, restarting a long flow, or running an expensive full test.
cannot see, such as canvases, maps, games, or non-semantic custom views.
Test execution behavior for the exceptions.
recover app state.
before dependent actions.
semantic visual state. Use visual-only AI checks only when the condition is fully visible and hierarchy data is unavailable, unreliable, or irrelevant.
uses one.
self-healing failed replay steps. Add --disable-cache to an AI_ACTION to run the agent fresh each time; prefer this for chats, agentic workflows, exploratory tests, and other dynamic or nondeterministic behavior.
style. Do not weaken a test to hide an app, asset, permission, data, or backend failure.
before / steps / after structure unless the testintent requires a change.
Momentic caches native selectors, XML nodes, visible text, webview state, coordinates, and other metadata. AI checks may also reuse past-result memory. Stale cache or memory can explain a fast wrong-target action or a repeated borderline verdict.
Cache is scoped by git metadata, including branch. Protected branches read cache but do not write it unless --save-cache is used or CI is set.
DANGEROUS_FORCE_DYNAMIC or --disable-cache to locator steps; built-in cache validation refinds changing targets. Disabling the cache is not a substitute for clarifying a vague description or fixing a timing or race condition. Add it only when told to, or when a cached locator already caused a failure that neither fix resolves.
CacheId into the exact step being spliced.emulator.smartWaitingTimeoutMs budgets readiness before AI locate, cached element retries, and other single-interaction waits. emulator.waitForStability instead waits after each interactive step so its effects land before the next step begins. Turn on waitForStability for apps that load incrementally, animate between screens, or are broadly slow. It does not control pre-targeting waits.
Within smart waiting, do not add sleeps. For longer or semantic readiness, use an element, screen, or AI check that describes the required positive state. Checks retry until their timeout; increase that timeout instead of polling with JavaScript. See mobile configuration for project-wide timing settings.
TYPE's keyboard-settling option. For masked or formatted fields that move the cursor, target the input explicitly and add a keypress delay when needed.
Scrolling down finds lower content, while swiping up moves the finger up to reveal it.
Test-level settings can override project platform, app asset, emulator, locale, timezone, geolocation, timeout, header, and environment defaults. Inspect both levels before changing behavior.
For managed assets, use the channels artifact from momentic_get_artifacts as the source of truth for valid platform channels, tags, and aliases. Follow the current tool description for defaultChannel and defaultTag behavior.
Each run has a test-scoped env that persists across steps and modules.
saveAs; in MCP step strings, use--env-key. Use setVariable(name, value) in JavaScript when saving several values.
env.NAME in JavaScript and module input expressions. Use{{ env.NAME }} in string fields, but not inside JavaScript source.
strings and use env.X for variables.
Use native tap, type, swipe, scroll, wait, and check steps for device behavior. They retain Momentic's targeting, smart waiting, cache, and traces. Do not use JavaScript to reproduce those actions or poll UI state when a check can retry.
Use mobile JavaScript for test setup, data generation, APIs, databases, OTP/email/SMS, assertions, and context writes that no native step expresses. Keep one-off code short; for reusable v2 scripts, follow nearby project conventions. See the mobile JavaScript command for current syntax.
Mobile v2 is human-editable. Tests use before, steps, and after; modules use steps. Each step has one command key, durations are milliseconds, and runnable step IDs are not stored in YAML.
Make the smallest edit and match nearby syntax. Common pitfalls:
0..100 in v2 YAML or 0..1 in MCP step strings.Consult File format for top-level structure and Steps for step syntax. Run npx momentic-mobile lint when schema or file-reference risk warrants it.
After a disk edit, reload the active MCP test if available; otherwise terminate and restart the session. momentic_test_get reads persisted state but does not refresh an active session.
Use tool descriptions and the platform-specific Step Authoring Guide returned by session start for current arguments and step syntax. Do not duplicate that reference material from this skill.
Do not call context tools as session-start boilerplate. Use them on demand and follow their descriptions, especially when they offer filters or return large project data.
momentic_session_start by itself. Its TestContent provides active steps and runnable IDs; the platform comes from the test.
momentic_get_artifacts only to discover unknown tests, modules,environments, local devices, simulators, or managed asset channels. Avoid redundant refreshes.
momentic_test_get to inspect persisted state before starting, or to reada different test. Prefer active session and splice responses afterward.
momentic_get_environment_variables only when a step needs envdata that is not already known.
momentic_module_recommend -> momentic_module_get only when evaluatingreuse; recommendation invokes AI and is not required to start a session.
Only one device operation may run per session. Do not issue concurrent preview, run, state, or splice operations against the same session.
session so authoring starts from the correct screen.
handled, form ready, submission complete, or confirmation visible.
image lacks enough targeting or diagnostic context; request it again once if the app may still be settling.
CacheId only to itsexact step, then read the splice response for current step refs.
stepRunnerId, poll it instead of starting another device operation.
prerequisites, changed step, and next dependent contract. Reset first only when accumulated state could mask a failure.
Batch obvious low-risk steps. Preview uncertain targets individually. For a non-idempotent action, preview setup, splice the checkpoint, then run the approved saved action at most once.
MCP screenshots are the default signal. Request serialized emulator state for accessible names, native XML, webview structure, screen bounds, or offscreen context. Read environment and installed-app artifacts only when diagnosing data, launch, or install behavior.
For a logical flow of roughly four or more reusable steps, check momentic_module_recommend -> momentic_module_get -> reuse or inline. Modules cannot contain modules. Ask before changing a shared module.
Respect declared parameters, defaults, and enum values. Module inputs are JavaScript fragments, not {{ }} templates.
state capture once if the app is settling.
check, or increase the existing check's timeout. Checks already retry; do not poll with JavaScript.
emulator.smartWaitingTimeoutMs. Do not use it to mask one slow assertion.
timeout, not a sleep.
resetSession: true.lost webview context, and repeated device-state capture failures as infrastructure or app-environment signals. Start with the doctor check above, inspect logs and device health, and retry from a clean session before editing the test.
work can block iOS accessibility snapshots. Prefer a test-mode switch that disables it; longer waits do not make a permanently busy app idle.
failures. Report the failing subsystem and supporting evidence separately from test logic.
not found: use visible text, role/name, and nearby context.
fractions use 0..1; v2 YAML uses percentages from 0..100.
SCROLL_TO when searching for a target. Use manual SWIPE only when notarget exists or scrolling is not appropriate.
describe meaning.
checks cannot inspect offscreen content or hierarchy.
state; use deterministic element or screen checks when they express the contract. See Writing assertions.
env.X versus{{ env.X }} at the consumer.
artifacts, and whether the session is remote or local.
After about three attempts at the same failure, stop and ask the user for direction.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.