Search skills/

Wonda CLI Claude skill

A paid CLI and 258 KB skill for AI image, video and audio generation, social publishing and logged-in LinkedIn, X and Reddit automation.

degausai/wonda 1 skill MarketingVideo & media
2/5 Depth expertise shipped ! Security Broad access 1d Maintenance Updated today 75K Adoption installs ? License no clear license

What Wonda CLI does

Wonda is a commercial command-line tool, and this repository carries the skill that teaches an agent to drive it. With the CLI installed from npm or Homebrew and an account created through wonda auth login, the agent can generate images, video, music and speech, run short-form video edits such as animated captions, merges, trims and split screens, publish to social platforms, and pull analytics for Instagram and TikTok. The skill also covers research and automation on LinkedIn, Reddit and X.

For the social features it uses the Wonda Automation Browser, which the skill describes as a premium stealth antidetect browser. It keeps persistent signed-in personas per platform, can click, type and scroll in them, and routes platform commands through stored account cookies. Access is paid only: the skill states a single plan of $49.99 per month with generations billed as credits, and the CLI performs a live entitlement check before doing work.

The repo is tiny, with a plugin manifest and one SKILL.md of about 258 KB (over 2,300 lines) and no reference files, so loading it consumes a very large amount of context. The skill documents a cookie cloud backup, on by default, that uploads your synced platform cookies to the vendor backend. There is no license file and no CI.

Good for

  • Existing Wonda subscribers who want an agent to run the CLI
  • Producing short-form social video and ad creatives from the terminal

Not for

  • Anyone unwilling to pay a subscription or share session cookies with a vendor
  • Accounts where platform terms forbid automation
  • Context-constrained agents, because of the 258 KB skill file

What's inside depth 2/5

One 258 KB SKILL.md with no references, scripts or tests; size is large but it is a single flat command manual for a closed CLI.

Skills
1
Reference docs
0
Scripts
0
Tests / evals
0
Templates
0
Avg SKILL.md
252.3 KB

Counted from the repository file tree. How we score depth.

Dependencies and costs

  • Wonda account on a paid plan with credits
  • Wonda CLI via npm or Homebrew, Node.js 20+
  • Chromium-based automation browser installed by wonda wab install
  • Accounts on the social platforms you automate
  • Telemetry: Cookie cloud backup is on by default and pushes synced platform cookie data to the Wonda backend after browser sessions; disable per machine with wonda wab backup disable. The CLI also performs a live entitlement check against Wonda before every command.

Security review

Broad access

This skill asks for more access than most, or sends data to another service. That is usually a design choice rather than bad intent, but you should know before you install it.

  • Loads instructions from a server at run timeget_content_skill fetches account-specific Markdown workflows from the Wonda server at runtime and server.ts tells the agent to fetch and follow the best match before building a workflow; content can change without a repo change.mcp/src/tools/skills.ts:40
  • Uploads your data by defaultCookie cloud backup is on by default: synced platform session cookies for LinkedIn/X/Reddit/Instagram are pushed to the Wonda backend (wire payload plaintext); opt out with wonda wab backup disable. Action logs also sync in the background when an API key is set (line 536).skills/wonda-cli/SKILL.md:457

A paid social-media automation and AI-media toolkit that drives your logged-in LinkedIn, X, Reddit and Instagram accounts through a closed-source CLI and a stealth browser. By default it backs up synced platform session cookies to the vendor's server and reports action-failure telemetry (both can be turned off), and the MCP server fetches vendor-hosted workflow instructions at runtime. Most behaviour lives in binaries not included in the repo, and automating accounts this way may breach those platforms' terms.

Worth knowing

  • Installs with curl | shDocumented install is curl -fsSL https://wonda.sh/install.sh | bash from the vendor's own host; the script in the repo downloads a release binary from GitHub and checks it against checksums.txt.install.sh:28
  • Changes files outside your projectAppends an export PATH=... line to the user's shell rc file (opt out with --no-modify-path) and installs the binary into ~/.wonda/bin.install.sh:183
  • Installs packages or toolsAfter a [Y/n] prompt on a real terminal, runs wonda app install, which downloads and runs the vendor's desktop installer (macOS asks for sudo); skipped in CI, with --no-app or WONDA_NO_AUTO_SETUP=1.install.sh:281
  • Relies on a CLI or package we could not reviewThe local MCP server shells out (execFile, no shell) to the closed-source wonda binary for every platform action; the Go CLI source is not in the repo.mcp/src/local-exec.ts:418
  • Runs remote code at an unpinned versionInstall instructions use npm i -g @degausai/wonda and npx @degausai/wonda without a version.skills/wonda-cli/SKILL.md:14
  • Needs an API key for its own serviceReads WONDA_API_KEY and sends it as a Bearer token only to api.wondercat.ai (or WONDA_BASE_URL).mcp/src/api.ts:40
  • Makes network requestsAll tools call the Wonda API at https://api.wondercat.ai/api/v1; upload_media (tools/media.ts) fetches any user-supplied http(s) URL and uploads it to the Wonda media library.mcp/src/api.ts:7
  • browser_session_optionalwonda <platform> auth set --from-keychain (opt-in) reads cookies from the browser Keychain; by default the agent drives the Wonda-managed persistent 'stealth antidetect' Chromium profile (wab_* tools, wab_eval runs page JavaScript) that holds the social-account sessions you log in to there.skills/wonda-cli/SKILL.md:1861
  • Sends usage data by default (can be turned off)Reports wab action failures (action, platform, reason, error string, CLI version) to PostHog by default; opt out with WONDA_TELEMETRY_DISABLED=1.skills/wonda-cli/SKILL.md:267

What we checked

The repository (47 files) on Oct 29, 2026. Not a full review: we read 21 of 33 code files; it relies on code outside the repository: wonda CLI binary (Go, closed source) installed via install.sh, npm @degausai/wonda or Homebrew; performs auth, cookie handling, backups, telemetry and entitlement checks; Wonda Automation Browser (stealth Chromium / Playwright fork) downloaded by `wonda wab install`; Wonda desktop app/relay installer downloaded by `wonda app install`.

NVIDIA SkillSpector static scan: 45 pattern hits (Rogue Agent 12, Supply Chain 9, Privilege Escalation 6, Excessive Agency 5, Memory Poisoning 4, Data Exfiltration 3). The YARA 'info_stealer' hits are documentation of the cookie-session design (cookies/WAB transports) in README and SKILL.md, not stealing code; the credential/Keychain hits are the opt-in --from-keychain option and the cookie backup described above. Self-update hits are the wonda_update tool, which downloads a checksum-verified .mcpb to ~/Downloads and opens it so Claude shows its own install dialog. 'sudo' is the desktop-app installer prompt.

A review, not a certification. Skills change after we check them — read the files before installing.

License

No license file or license metadata found — all rights reserved by default. The CLI itself is a paid commercial service.

Can it run unattended?

Not really. It is a command manual for a paid CLI; automation of logged-in social accounts needs close supervision and risks account restrictions.

Alternatives to Wonda CLI

HyperFrames

heygen-com/hyperframes

HeyGen's framework and skills for writing HTML and rendering it to deterministic MP4 video, with a CLI, a block registry and media tooling.

With caveats Broad access Depth 4/5

Remotion Agent Skills

remotion-dev/skills

The Remotion team's twelve skills for building videos as React code: project setup, markup rules, maps, captions, studio, render and upgrades.

Recommended Check first Depth 3/5

Higgsfield AI Skills

higgsfield-ai/skills

Nine skills for generating images, video, brand kits, product shots and websites through the paid Higgsfield service and its CLI.

With caveats Broad access Depth 3/5

BrowserAct Skills

browser-act/skills

A browser-automation CLI skill with stealth browsers, CAPTCHA solving and handoff to a human, plus about 100 ready-made scraper skills for shops and lead sources.

With caveats Broad access Depth 3/5

FAQ

What is Wonda CLI?

Wonda is a paid command-line tool for generating and editing images, video, music and audio and for publishing to social platforms. This repository contains the agent skill and plugin manifest that teach an agent to use it.

How do I install Wonda?

Install the CLI with npm i -g @degausai/wonda or brew tap degausai/tap && brew install wonda, run wonda auth login, then add the skill with npx skills add degausai/wonda or the Claude Code plugin marketplace. A paid account is required.

Is Wonda safe to use?

We rate its security as a concern. The skill documents a default-on cookie backup that uploads your signed-in platform cookies to the vendor, which you can switch off with wonda wab backup disable, and an antidetect browser for automating social accounts.

Is Wonda free?

No. The skill says every product surface needs a paid plan, listing a single plan at $49.99 per month with generations billed as credits.

Sources: GitHub repository (stars, license, file tree, last push Oct 28, 2026); install counts from skills.sh via Best Skills (CC BY 4.0). Review based on the README and SKILL.md files as published.