ClawHub
Back to skill

Security audit

Context7 API Documentation Fetcher

Security checks for vulnerabilities and agentic risk

Overview

This documentation-fetching skill is mostly purpose-aligned, but it ships a hardcoded Context7 API key and encourages broad proactive use of an external network service without enough disclosure or scoping.

Review before installing. The skill does what it claims at a high level, but it contacts Context7 frequently by design and includes a bearer token in the distributed source. Install only if you are comfortable sending documentation search terms to Context7, and prefer a version that removes the embedded key, requires your own securely supplied credential, and narrows when the skill should run.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/context7.py:15
Finding

Hard-Coded Context7 API Credential

Content
View full analysis

Vulnerability Details

File Location: scripts/context7.py, line 15
Vulnerability Type: Hard-coded API bearer token
Risk Level: High

Vulnerable Code

python
API_KEY = os.environ.get("CONTEXT7_API_KEY", "ctx7sk-d6069954-149e-4a74-ae8f-85092cbfcd6f")

Technical Analysis

The script embeds a Context7 API key as the default value used whenever the CONTEXT7_API_KEY environment variable is absent. Because the credential is distributed with the source code, anyone who can obtain the Skill package can extract it without executing the script.

The environment-variable override does not protect the embedded fallback. The script subsequently places this credential in an HTTP Authorization: Bearer header for requests to Context7. Although HTTPS protects the credential in transit under normal certificate validation, it does not mitigate disclosure from the source code.

Attack Path

  1. An attacker obtains or reads the distributed Skill package.
  2. The attacker opens scripts/context7.py and extracts the fallback bearer token from line 15.
  3. The attacker submits authenticated requests to supported Context7 API endpoints using the exposed token.
  4. Requests consume the credential owner's API quota and are attributed to that credential until it is revoked or expires.

No additional local privilege escalation is required because the secret is directly readable from the source.

Impact Assessment

The attacker gains the Context7 API privileges assigned to the exposed credential. Potential consequences include unauthorized API use, quota or rate-limit consumption, unexpected service costs where applicable, activity attribution to the credential owner, and disruption if abuse causes throttling or revocation.

The audit found no evidence that this token grants local system privileges, accesses unrelated host secrets, or permits arbitrary code execution. The impact is limited to the authority and scope ...[truncated 48 chars]

Remediation
View remediation

Remediation Suggestions

  1. Immediately revoke and rotate the exposed Context7 API credential.
  2. Remove the fallback secret and require explicit credential provisioning:
    python
    API_KEY = os.environ.get("CONTEXT7_API_KEY")
if not API_KEY:
    raise RuntimeError("CONTEXT7_API_KEY is required")
  3. Supply the credential through a protected environment variable or secret-management service at runtime.
  4. Ensure secrets are excluded from source control, release archives, logs, examples, and documentation.
  5. Add automated secret scanning to commit and release workflows.
  6. Use a narrowly scoped credential with appropriate rate limits, expiration, monitoring, and rotation policies.
  7. Review Context7 access logs for unauthorized use of the disclosed credential.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (8)

Tainted flow: 'req' from os.environ.get (line 21, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/context7.py (reported line 24)May include surrounding context.

python
req = urllib.request.Request(url, headers=headers)

    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            content_type = response.headers.get("Content-Type", "")
            data = response.read().decode("utf-8")
            if "application/json" in content_type:

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates the underlying script embeds a hardcoded default API key or other credential and performs authenticated external API access that is not disclosed in the skill description. Hidden credentials and undisclosed authenticated network behavior are dangerous because they can enable unauthorized API use, make auditing difficult, and mask data flows to third parties.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill instructs the agent to run a Python script that uses network and likely environment-backed capabilities, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: reviewers and users cannot easily tell that the skill performs external access and may touch sensitive execution capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are very broad, covering essentially any work involving external libraries and instructing proactive use. In context, this can cause frequent unintended invocation of a networked skill, increasing exposure of user prompts, code context, and workflow metadata to an external service beyond what is necessary.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
(3) Implementing features that rely on third-party packages
  (4) Debugging library-specific issues
  (5) Need current documentation beyond training data cutoff
  Always prefer this over guessing library APIs or using outdated knowledge.
---

# Context7 Documentation Fetcher

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code embeds a default API key directly in source, which is a hardcoded secret. Anyone with access to the code can extract and abuse the credential for unauthorized API usage, billing impact, or service abuse, and the skill context makes this more dangerous because the script is explicitly designed for routine outbound authenticated requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code sends the user's query and library_id parameters to the external Context7 API via an HTTP request, but the script provides no user-facing warning, confirmation, or output indicating that input data is being transmitted off-system. The docstrings describe functionality but do not disclose the privacy-relevant behavior of sending user-provided content to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The script reads an API key from the CONTEXT7_API_KEY environment variable and uses it for authenticated requests, but there is no warning or visible documentation in this file that credentials are being consumed for outbound authentication. For code-file warning checks, sensitive credential access should have at least some disclosure through comments, help text, or user-visible logging unless already clearly documented elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.