T08 · Insecure Dependencies
Warning
- Location
setup.md:22- Finding
Unpinned Cypress Dependency Is Installed and Immediately Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
Cypress
Security checks for vulnerabilities and agentic risk
Overview
This Cypress testing skill is mostly ordinary, but some templates contradict its privacy promises by enabling Cypress Cloud recording and optional cross-project home-directory memory.
Review before installing. Remove or explicitly opt into Cypress Cloud recording, do not use production secrets or sensitive data in tests, restrict CI artifact access and retention, pin Cypress and GitHub Actions versions where possible, and avoid creating ~/cypress/memory.md unless you want cross-project testing notes retained outside the repository.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
ci.md:60- Finding
Cypress Cloud Upload Is Enabled Despite Claims That Data Remains Local
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
memory-template.md:5- Finding
Optional Memory Instructions Write Cross-Project State Outside the Declared Project Boundary
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
})
text ### 7. Isolation: Reset State Before Tests ```typescript beforeEach(() => { cy.intercept('GET', '/api/notifications', { body: [] })
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
md - Cypress runs locally or in your own CI environment **This skill does NOT:** - Send data to external services - Require API keys or authentication - Access files outside project directory
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - Cypress runs locally or in your own CI environment **This skill does NOT:** - Send data to external services - Require API keys or authentication - Access files outside project directory
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The artifact upload example encourages preserving Cypress screenshots on failure without warning that screenshots and videos can capture PII, secrets, session state, internal URLs, or sensitive business data visible during tests. In CI systems, artifacts are often retained, shared across teams, or exposed to broader roles than production data, creating a realistic confidentiality risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The parallel test configuration enables
record: trueand uses a secrets-backedCYPRESS_RECORD_KEY, but it omits any warning that test metadata, screenshots, videos, DOM snapshots, logs, and other execution artifacts may be transmitted to Cypress Cloud. In a CI/testing skill, this is more dangerous because users may copy-paste the example into environments containing real or staging-sensitive data without understanding the privacy implications.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file includes
cy.requestexamples that send user data over the network and access credentials viaCypress.env('API_TOKEN')and login tokens. The surrounding documentation does not provide any warning or disclosure about transmitting credentials or sensitive request data during testing.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The setup instructions tell users to run
npx cypresswithout pinning a specific version. This can fetch and execute whatever version is current at the time of use, reducing build reproducibility and creating supply-chain risk if an upstream package version is compromised or unexpectedly changed.- Content
Static analysis
No suspicious patterns detected.