The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests untrusted data from an external API and processes it without explicit boundary markers or sanitization.
Ingestion points: Data is retrieved from the context7.com/api/v1/search and context7.com/api/v1/{libraryId} endpoints (documented in SKILL.md).
Boundary markers: The skill does not provide instructions to wrap the external content in delimiters or ignore embedded instructions before processing or outputting it to the user.
Capability inventory: The agent uses curl for network requests and python3 for processing JSON data. It also possesses the ability to execute shell commands as demonstrated in the 'Common patterns' section.
Sanitization: There is no evidence of validation or escaping for the libraryId variable before it is interpolated into a shell command string. A malicious API response could potentially include shell metacharacters to attempt command injection.
[COMMAND_EXECUTION]: The skill provides shell command patterns for resolving library IDs and fetching documentation. While these are functional examples, the use of LIB_ID=$(...) followed by a curl call using that variable (https://context7.com/api/v1${LIB_ID}...) represents a potential command injection vector if the external API provides a crafted response.
[CREDENTIALS_UNSAFE]: The skill follows security best practices for credential management. It uses an environment variable ($CONTEXT7_API_KEY) and explicitly instructs the agent and user not to echo the variable directly to prevent leaking secrets into conversation transcripts.

context7