Security audit

Cypress Agent Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly Cypress testing guidance, but its install docs include unverified remote code execution and unpinned CLI execution that users should review before installing.

Review the install instructions before use. Prefer ClawHub or a reviewed git clone over the curl-to-bash installer, avoid unpinned npx -y commands, and only copy database reset, secret, payment, and CI artifact examples into isolated test environments with explicit non-production checks.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: README.md:59
Finding: Mutable Remote Shell Script Is Downloaded and Executed Without Verification
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:69
Finding: Unpinned Third-Party CLI Is Automatically Downloaded and Executed
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (56)

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · SKILL.md (reported line 490)May include surrounding context.
md
cy.wait('@getResults') cy.get('[data-testid="result"]').should('have.length.greaterThan', 0) // Test isolation — reset state between tests beforeEach(() => { cy.clearAllCookies() cy.clearAllLocalStorage()

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 818)May include surrounding context.
md
- `custom-commands.js` — Custom command library

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The examples include resetDatabase() and truncation/seeding operations with no cautionary language, making destructive database actions appear routine and safe to copy. In an agent skill, that is especially risky because automation may apply the pattern in the wrong environment, causing irreversible data loss in shared or production databases.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README promotes bash <(curl -fsSL ...), which downloads and immediately executes a remote shell script with no warning, review step, or integrity verification. This is dangerous because any compromise of the GitHub account, repository, branch, DNS/TLS trust chain, or the script itself results in arbitrary code execution on the user's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx -y @lobehub/market-cli without pinning a specific version, which causes execution of whatever package version is current at install time. If the package is compromised, unpublished/replaced, or a malicious update is released, users may execute attacker-controlled code during skill installation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: This second npx -y @lobehub/market-cli invocation has the same supply-chain risk: it fetches and runs an unpinned package directly from the registry. In a skill README, such copy-paste commands are especially risky because users and agents may execute them verbatim with little scrutiny.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This section presents non-standard or incorrect Cypress APIs such as cy.env() and Cypress.expose() as required replacements for Cypress.env(), which can mislead users into breaking authentication and secret-handling logic. In a security-sensitive area like credentials and environment variables, inaccurate guidance can cause teams to implement unsafe workarounds, leak secrets into browser state, or disable expected controls while troubleshooting.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The cypress.env.json example contains realistic secret placeholders and only briefly says to gitignore the file, without strongly warning against committing real secrets or demonstrating safer secret injection patterns. In practice, users often copy documentation verbatim, so this can lead to plaintext credentials being stored in repos, shared in forks, or exposed in CI artifacts.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill describes cy.prompt() and self-healing natural-language execution as if they are standard Cypress features, which can cause users or downstream agents to rely on nonexistent behavior for test generation or interaction. In an agent context, fabricated capabilities are risky because they can prompt unsafe automation assumptions, conceal failures, or encourage blind trust in intent-based execution rather than explicit selectors and assertions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code accesses a sensitive environment variable, TEST_SECRET, and sends it over HTTP in the x-test-secret header for both seed and reset operations. Although the operations are commented as API seeding/reset helpers, there is no visible confirmation, logging, or explicit warning in this file that a credential is being used and transmitted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: resetDatabase triggers a /test/reset API call, which is a destructive and potentially irreversible action. The brief comment identifies the action but does not provide a real safety warning, confirmation step, or user-facing disclosure about impact or environment constraints.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code file handles payment card number and CVV inputs directly, but unlike the password field earlier in the file, it provides no masking option, user-facing notice, or comment explaining that sensitive payment data is being entered. For code-file warning checks, access to sensitive data should have some visible disclosure unless clearly documented as expected behaviour, and this section lacks that context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The CI examples automatically upload Cypress screenshots and videos as artifacts without warning that these files can contain sensitive information such as user data, tokens shown in the UI, internal URLs, or test-environment business data. In a production-grade testing skill, this omission is more dangerous because users are likely to copy the workflow directly into real CI systems where artifacts may be broadly accessible or retained for long periods.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.