The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/fetch-raw.sh script constructs a JSON payload using an unquoted heredoc (cat <<JSON). This configuration causes the shell to process the contents of the heredoc, including expansion and command substitution of the $TOPIC variable. If the variable contains subshell syntax (e.g., $(whoami)), the command is executed by the host shell during the script's execution.
[COMMAND_EXECUTION]: In scripts/fetch-docs.sh, user-supplied parameters such as --topic and --library are directly interpolated into a shell command string used to invoke mcp-client.py. Because the variables are not sanitized for shell metacharacters, an attacker can break out of the intended command string and execute arbitrary shell commands (e.g., by providing a topic string containing "; id #).
[DYNAMIC_EXECUTION]: The scripts/mcp-client.py script uses subprocess.Popen with shell=True to launch the MCP server. The command string is constructed by concatenating the CONTEXT7_API_KEY retrieved from local configuration files. If the configuration file is manipulated to include shell command separators in the key value, it results in arbitrary command execution when the skill is invoked.
[EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and execute the @upstash/context7-mcp package from the NPM registry. This is a download from a well-known and established service provider (Upstash) and is consistent with the skill's primary function of documentation retrieval.
[INDIRECT_PROMPT_INJECTION]: The skill ingests documentation content from external sources, creating a potential surface for indirect prompt injection.
Ingestion points: External library documentation retrieved through the query-docs tool and processed by fetch-docs.sh.
Capability inventory: The skill environment possesses the capability to execute shell commands, Python scripts, and network requests.
Boundary markers: The skill uses filtering scripts (filter-by-type.sh) to organize content into markdown sections, but it does not employ explicit boundary markers or instructions to prevent the agent from obeying instructions embedded within the fetched text.
Sanitization: Content is filtered for specific block types (like code or prose) using awk and grep, but no logic is present to sanitize or escape potentially malicious instructions.

fetch-library-docs