Context7 Cli

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:32 AM UTC
• Version: 0.1.0

Overview

The skill is for fetching Context7 documentation, but its setup instructions ask users to run mutable, unpinned third-party installers and make a persistent PATH change.

Review this skill carefully before installing. The normal documentation commands are coherent, but the setup path should be treated as high trust: install Bun and the Context7 CLI only through a verified, pinned method, inspect what will be linked into PATH, and avoid giving the process access to unrelated credentials or sensitive project environments.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:18
• Finding: Mutable Remote Installer Is Executed Directly Through Bash## Vulnerability Details **File Location**: `SKILL.md`, line 18 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High **Vulnerable Code**: ```bash bun --version || curl -fsSL https://bun.sh/install | bash ``` ### Technical Analysis When Bun is unavailable, the command downloads the current response from `https://bun.sh/install` and immediately passes it to Bash. The remote script is neither version-pinned nor authenticated through a checksum or cryptographic signature. It is also not saved for inspection before execution. Consequently, the code that ultimately runs can change after the Skill has been reviewed. Compromise of the remote service, its deployment pipeline, or the applicable DNS/TLS trust path could cause arbitrary shell commands to be returned and executed. Bun may be needed by the subsequent build operation, but executing a mutable remote response through `curl | bash` is not the minimum privilege or minimum-risk installation mechanism necessary for the Skill's documentation-querying purpose. ### Attack Path 1. Bun is absent from the user's environment. 2. The user or agent follows the setup instructions in `SKILL.md`. 3. The shell evaluates the fallback after `bun --version` fails. 4. `curl` retrieves a mutable script from the external endpoint. 5. The response is streamed directly into Bash without integrity verification or review. 6. A malicious or compromised response executes arbitrary commands with the permissions of the invoking user. ### Impact Assessment A malicious response can obtain the invoking user's privileges and access files, environment variables, credentials, and network resources available to that account. It could modify shell configuration, install additional software, or establish persistence, although the reviewed Skill does not itself explicitly instruct the installer to perform those actions. If Context7 credentials are already ...[truncated 261 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation instruction. - Declare Bun as an explicit prerequisite and direct users to an approved package manager or official manual installation process. - Pin Bun to a reviewed version. - Download the installer or release artifact separately, verify its published cryptographic signature or SHA-256 checksum, and only then execute or install it. - Avoid automatic installation during Skill execution; require explicit user approval before changing the local development environment. - Run installation with ordinary user privileges and do not request `sudo` or administrator access.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:11
• Finding: Unpinned Third-Party Tooling and GitHub Source Are Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 11-20 **Vulnerability Type**: Unpinned executable dependencies and mutable source installation **Risk Level**: High **Vulnerable Code**: ```bash If `context7-cli` is not installed, install it from GitHub: ```bash npx api2cli install Melvynx/context7-cli ``` If `context7-cli` is not found, install and build it: ```bash bun --version || curl -fsSL https://bun.sh/install | bash npx api2cli bundle context7 npx api2cli link context7 ``` ``` ### Technical Analysis The `api2cli` package is invoked through `npx` without an exact version or integrity constraint. If it is not already available locally, `npx` may retrieve the current package release and execute its package code. The effective dependency can therefore differ from the version that existed when this Skill was audited. The GitHub source reference `Melvynx/context7-cli` is also not pinned to a reviewed commit hash or signed release. A compromised package-registry account, GitHub maintainer account, repository, or upstream release process could substitute attacker-controlled code. The subsequent `bundle` and `link` operations process and expose the installed CLI. The documentation also states that linking adds `~/.local/bin` to `PATH`, representing a persistent change to the user's shell environment. While linking a CLI may be operationally useful, automatic PATH modification should be disclosed and approved, and it does not remove the dependency-integrity risk. ### Attack Path 1. The user or agent follows the setup instructions because `context7-cli` is unavailable. 2. `npx` resolves an unpinned version of `api2cli`, potentially downloading it from the package registry. 3. Registry-distributed package code executes with the invoking user's permissions. 4. `api2cli` obtains or processes the unpinned GitHub project. 5. A compromised upstream package or repository supplies malicious code. 6. ...[truncated 961 chars]
• Remediation: ## Remediation Suggestions - Pin `api2cli` to an exact reviewed version, for example through an explicit version-qualified invocation and a lockfile with integrity metadata. - Pin `Melvynx/context7-cli` to a specific audited commit hash or cryptographically signed release rather than a mutable repository reference. - Verify package integrity, release signatures, provenance attestations, and maintainer identity before installation. - Prefer a reviewed local dependency installation over automatically downloading and executing packages through `npx`. - Document every file and shell configuration change made by `api2cli link`. - Require explicit user consent before adding `~/.local/bin` to PATH. - Avoid installation during ordinary Skill use; separate trusted setup from documentation-query operations. - Execute the CLI under ordinary user privileges and restrict access to unrelated credentials and sensitive environment variables.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

External Script Fetching

High

• Category: Supply Chain

Content

If `context7-cli` is not found, install and build it:
```bash
bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle context7
npx api2cli link context7
```

• Confidence: 99% confidence
• Finding: `curl -fsSL https://bun.sh/install | bash` fetches a remote script and immediately executes it in the shell, which is a classic high-risk pattern. If the remote host, transport path, or delivered script is compromised, arbitrary code will run on the user's machine with the user's privileges.

Chaining Abuse

High

• Category: Tool Misuse

Content

If `context7-cli` is not found, install and build it:
```bash
bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle context7
npx api2cli link context7
```

• Confidence: 98% confidence
• Finding: The `| bash` pipeline chains network retrieval directly into command execution, removing any opportunity to inspect the downloaded content first. In this skill context, the command appears as routine setup guidance, which makes unsafe execution more likely and increases the chance of silent compromise.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence
• Finding: The skill instructs users to run `npx api2cli install Melvynx/context7-cli` without pinning a specific package version. This creates a supply-chain risk because future package changes or a compromised dependency could cause different code to be fetched and executed than what was originally reviewed.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill includes installation steps that execute shell commands, install tooling, and modify PATH behavior, but does not clearly warn users about system changes or security implications. This can lead users or downstream agents to make privileged environment changes without informed consent or review.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The command `npx api2cli bundle context7` relies on an unpinned `api2cli` tool version. Because `npx` resolves packages dynamically, the behavior and code executed may change over time, exposing users to unintended or malicious upstream updates.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The command `npx api2cli link context7` also invokes an unpinned package via `npx`, which can execute arbitrary updated package code at runtime. In a skill that tells users to install and link tooling automatically, this increases supply-chain exposure.

Static analysis

No suspicious patterns detected.