cypress-cloud-cli
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the
@cypress/cloudpackage from the official NPM registry. This package is maintained by a trusted vendor and is essential for the skill's functionality. - [COMMAND_EXECUTION]: The skill uses the
cy-cloudcommand-line interface to perform data lookups and triage operations. These commands are used as intended for inspecting test results, runs, and artifacts. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and interpret JSON output from Cypress Cloud API calls via the CLI.
- Ingestion points: The agent ingests data from various
cy-cloudcommands, includingrun list,spec list, andreplay timelineininvestigation.mdandtest-replay.md. - Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the JSON data, but the data is structured and expected to be machine-generated.
- Capability inventory: The agent can execute CLI commands and write failure screenshots to the
./artifactsdirectory as described ininvestigation.md. - Sanitization: No specific sanitization or schema validation is mentioned for the processed JSON, though the skill relies on the CLI's
--schemaflag for contract validation. - [CREDENTIALS_UNSAFE]: The skill demonstrates safe credential handling by advising the use of environment variables (
CYPRESS_CLOUD_TOKEN) and providing explicit instructions to never print, echo, or read back tokens, and to never inspect local authentication configuration files like~/.config/cy-cloud/auth.json.
Audit Metadata