Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent and not malicious, but it asks agents to run mutable external CLI code, sometimes outside the sandbox, and includes commands that can change global agent configuration and installed skills.
Install only if you are comfortable with Context7 CLI network calls and agent-configuration changes. Prefer a pinned, reviewed ctx7 version, avoid sending secrets or proprietary code in doc queries, and review any setup, --global, --all, --yes, login, install, or remove command before running it.
The activation criteria are overly broad, including generic 'how do I' questions about libraries and many common programming scenarios. In a skill that instructs external CLI usage and out-of-sandbox network access, over-triggering increases the chance the agent will invoke unnecessary third-party tooling, expanding attack surface and causing unsafe or irrelevant command execution.
The skill instructs users to execute npx ctx7 without a pinned version, which allows whatever package is currently published under that name to be fetched and executed at runtime. Even though other examples use @latest, that is still unpinned and can introduce malicious or breaking upstream changes into the agent workflow.
This reference uses npx ctx7 without an exact version, creating a supply-chain risk because npx will resolve and execute the current package version from the registry. In an agent skill, this is more dangerous because the document is prescribing operational behavior that may be followed automatically or with reduced scrutiny.
The command example at this line invokes npx ctx7 without version pinning, allowing registry-side changes to alter executed code over time. Because this skill is specifically about fetching external documentation and configuring tooling, it normalizes repeated network execution of mutable code, increasing exposure to compromise.
This version-specific docs example still relies on an unpinned npx ctx7 executable, so while the library ID is pinned to a docs version, the CLI itself is not. An attacker controlling or compromising the package publication path could execute arbitrary code before any documentation lookup occurs.
The docs lookup command is shown with npx ctx7 and no exact version, making the command susceptible to package substitution or malicious updates. In the context of an agent skill, unsafe examples can propagate into repeated automated use across many sessions.
The login instruction uses npx ctx7@latest, which is still mutable and therefore not safely pinned. Combining authentication steps with execution of latest-tagged code is particularly risky because it may expose tokens or session state to compromised package code.
The quota-error recovery guidance again directs users to run npx ctx7@latest login, which executes mutable code at the point users are likely to be troubleshooting and less cautious. Although not obviously malicious, it reinforces insecure operational practice and can lead to credential theft if the package supply chain is compromised.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
ctx7 setup # Interactive — prompts for mode, then agent/install target
ctx7 setup --mcp # Skip prompt, use MCP server mode
ctx7 setup --cli # Skip prompt, use CLI + Skills mode
# MCP mode — target a specific agent
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
ctx7 setup # Interactive — prompts for mode, then agent/install target
ctx7 setup --mcp # Skip prompt, use MCP server mode
ctx7 setup --cli # Skip prompt, use CLI + Skills mode
# MCP mode — target a specific agent
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
ctx7 setup --cli --antigravity # Antigravity (~/.config/agent/skills)
ctx7 setup --project # Configure current project instead of globally ctx7 setup --yes # Skip confirmation prompts
**Authentication options:**
This markdown documents --global installation, which writes into the user's home-directory skill locations, but it does not explicitly warn that the change affects all projects for that IDE target. Similar global scope is also shown for removal later, making the operational impact broader than project-local actions.
The Remove section says 'Uninstall a skill by name' and gives deletion commands, but it does not explicitly disclose that installed files will be removed from project or global skill directories. For a destructive operation, a clear warning helps users understand the impact before running the command.
No suspicious patterns detected.