context7-cli
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
ctx7CLI to perform library lookups, fetch documentation, and manage agent instructions. This includes executing shell commands to configure environment variables and modify local agent configuration files such as.mcp.jsonand.claude/skillsfor various editors. - [EXTERNAL_DOWNLOADS]: Instructions guide the user to install the
ctx7utility via the NPM registry and to download additional agent skills from GitHub repositories using thectx7 skills installcommand. These resources are fetched from well-known public registries and source control platforms. - [DATA_EXFILTRATION]: Documentation search queries and library resolution requests are transmitted to the Context7 API. The skill documentation includes a proactive security warning advising users to avoid including sensitive or personal data in their search terms.
- [REMOTE_CODE_EXECUTION]: The tool supports the installation and execution of external instruction sets (skills) from GitHub repositories and the generation of new instruction files via an AI service, which are subsequently integrated into the agent's context.
- [PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by ingesting data from external documentation and remote skills while possessing the capability to execute commands and modify system files.
- Ingestion points: External documentation fetched via
ctx7 docs(references/docs.md) and third-party skills installed viactx7 skills install(references/skills.md). - Boundary markers: The skill does not implement explicit delimiters or boundary warnings for the content returned from documentation queries.
- Capability inventory: Shell command execution via the
ctx7CLI and file system writes for agent configuration as described in references/setup.md. - Sanitization: While users are warned not to provide sensitive inputs, there is no technical validation or sanitization of the content retrieved from the remote service.
Audit Metadata