Find Docs
Analysis
This is a coherent documentation-lookup skill, but users should notice that it relies on an external npm CLI, may send queries to Context7, and optionally uses Context7 credentials.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
npm install -g ctx7@latest
The skill suggests installing the latest external npm package, which is purpose-aligned for using Context7 but is unpinned and can change over time.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
export CONTEXT7_API_KEY=your_key
The skill optionally supports a Context7 API key or OAuth login for higher rate limits, which is expected for this service but involves user credentials.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Use the user's full question as the query when possible
The skill sends user-derived documentation queries through Context7; it also warns not to include secrets or proprietary data, which makes the data flow disclosed but still worth noticing.