cypress-ops

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The Quick Start example recommends passing the Cypress record key directly on the command line (npx cypress run --record --key <k>), which requires inserting a secret verbatim into an output/command and is an insecure credential-handling pattern.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CI examples reference GitHub Actions and a container image that are fetched and executed at runtime (e.g., actions/checkout@v5, cypress-io/github-action@v6, cypress/browsers:node-22.11.0-chrome-131-ff-133), meaning external code would be pulled and run during CI runs.