cypress-cloud-cli

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the @cypress/cloud package from the official NPM registry. This package is maintained by a trusted vendor and is essential for the skill's functionality.
  • [COMMAND_EXECUTION]: The skill uses the cy-cloud command-line interface to perform data lookups and triage operations. These commands are used as intended for inspecting test results, runs, and artifacts.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and interpret JSON output from Cypress Cloud API calls via the CLI.
  • Ingestion points: The agent ingests data from various cy-cloud commands, including run list, spec list, and replay timeline in investigation.md and test-replay.md.
  • Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the JSON data, but the data is structured and expected to be machine-generated.
  • Capability inventory: The agent can execute CLI commands and write failure screenshots to the ./artifacts directory as described in investigation.md.
  • Sanitization: No specific sanitization or schema validation is mentioned for the processed JSON, though the skill relies on the CLI's --schema flag for contract validation.
  • [CREDENTIALS_UNSAFE]: The skill demonstrates safe credential handling by advising the use of environment variables (CYPRESS_CLOUD_TOKEN) and providing explicit instructions to never print, echo, or read back tokens, and to never inspect local authentication configuration files like ~/.config/cy-cloud/auth.json.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 02:36 AM