Cypress Agent Skill

• Analyzed: May 11, 2026, 5:37 AM
• Findings: 1
• Version: 0.1.0
• Hash: 4a40476402488a12fd53dbfa60a60968f8e59789243b6bb643d2dc00d7155612
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains extensive misinformation regarding the Cypress testing framework, including references to non-existent versions (v15.x) and fake APIs such as `cy.env()`, `Cypress.expose()`, and `cy.prompt()`. The instructions in `SKILL.md` and `references/config.md` explicitly direct AI agents to deprecate standard, functional APIs (`Cypress.env()`) and enforce configurations (`allowCypressEnv: false`) that would break legitimate testing environments. While the `README.md` promotes a risky `curl | bash` installation pattern, there is no clear evidence of intentional data exfiltration or backdoor persistence, suggesting the bundle is designed to mislead or disrupt rather than directly infect.