The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill instructs the agent to access sensitive local files, specifically ~/.codex/.env, using the op run utility to inject credentials for the Context7 CLI. While the provided Python script scripts/context7.py includes an allowlist for network requests (context7.com, api.context7.com), the requirement to handle and authenticate with sensitive environment files increases the risk of accidental exposure or exfiltration if the agent's context is compromised.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The 'Skill Wizard' feature (ctx7 skills install /owner/repo) allows for the installation of agent skills from any user-specified GitHub repository. Since agent skills are essentially sets of instructions and potentially scripts that the agent executes, this capability allows for the introduction of unverified and potentially malicious code into the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process external documentation from the Context7 API, creating a surface for indirect prompt injection where malicious content in the documentation could influence agent behavior.
Ingestion points: Documentation is ingested via the mcp__context7__query_docs tool and the scripts/context7.py helper script.
Boundary markers: The instructions lack explicit requirements for the agent to use strict delimiters or isolation techniques when processing retrieved documentation excerpts.
Capability inventory: The skill provides the agent with shell command execution privileges (ctx7 CLI) and file system access (reading .env and writing skills during installation).
Sanitization: There are no documented procedures for validating or sanitizing the content of the retrieved documentation before it is processed by the LLM.

context7