context7-skills

SUSPICIOUS. The skill’s behavior matches its stated purpose, and `ctx7` appears to be the official same-org CLI, so this is not malware-like deception. The main risk is transitive trust: it is explicitly designed to install third-party skills, extending agent privileges to unreviewed external instruction sets; combined with unpinned `npx` execution, that makes it medium/high security risk despite otherwise coherent scope.