context7-auto-research
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it retrieves documentation from an external source and integrates it into the agent's context without isolation. \n
- Ingestion points: Data enters via the
scripts/context7-api.cjsscript which fetches content fromhttps://context7.com/api/v2/context. \n - Boundary markers: The instructions lack boundary markers or delimiters (such as XML tags) to separate external data from the agent's instructions, nor do they advise the agent to ignore embedded commands in the documentation. \n
- Capability inventory: The agent has access to the
BashandReadtools, providing a mechanism for malicious instructions to be executed if they are processed from the API response. \n - Sanitization: There is no evidence of sanitization or validation of the fetched documentation content before it is processed by the AI. \n- [COMMAND_EXECUTION]: The skill instructions for the
Research Process(Step 2 and Step 4) direct the agent to construct shell commands by interpolating user-provided queries into string templates (e.g.,node scripts/context7-api.cjs search "<library-name>" "<user-query>"). \n - Unsafe interpolation: The user's query is placed directly inside quotes within a shell command line. \n
- Risk: If a user provides a query containing shell control characters (like backticks or semicolons) and the agent fails to escape them, it could lead to arbitrary command execution on the host machine.
Audit Metadata