context7-mcp-skill
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill configuration and instructions follow standard patterns for MCP tool integration. It uses the uxc tool (provided by the same vendor) to create a local command interface for the mcp.context7.com documentation service.
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves documentation and code examples from an external API, creating a surface for potential indirect prompt injection if the source content is compromised.
- Ingestion points: Data returned by the query-docs tool in SKILL.md and references/usage-patterns.md.
- Boundary markers: None specified in the instructions for isolating external content.
- Capability inventory: Shell execution capabilities via the context7-mcp-cli command.
- Sanitization: No evidence of validation or sanitization of the fetched documentation data.
Audit Metadata