cy-loop-tasks

SUSPICIOUS: the skill's core purpose is an autonomous execution loop, but it explicitly suppresses user confirmation and invokes a frontend worker with --yolo while also performing commits, pushes, and PR operations. No clear malware or credential-harvesting path is shown, but the approval-bypass and autonomous real-world actions create significant security risk.