context7-cli

SUSPICIOUS: the skill is mostly coherent with its stated purpose and uses the publisher's official npm distribution, so it is not malware-like. The main concern is transitive trust: it teaches the agent to install additional skills from arbitrary GitHub repositories, extending permissions to unreviewed third-party content; setup also writes agent configs and may forward credentials to the external CLI.