Context7 Cli

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:32 AM UTC
• Version: 0.1.0

Overview

The skill is for fetching Context7 documentation, but its setup instructions ask users to run mutable, unpinned third-party installers and make a persistent PATH change.

Review this skill carefully before installing. The normal documentation commands are coherent, but the setup path should be treated as high trust: install Bun and the Context7 CLI only through a verified, pinned method, inspect what will be linked into PATH, and avoid giving the process access to unrelated credentials or sensitive project environments.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:18

Finding

Mutable Remote Installer Is Executed Directly Through Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 18
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Vulnerable Code:

bash

bun --version || curl -fsSL https://bun.sh/install | bash

Technical Analysis

When Bun is unavailable, the command downloads the current response from https://bun.sh/install and immediately passes it to Bash. The remote script is neither version-pinned nor authenticated through a checksum or cryptographic signature. It is also not saved for inspection before execution.

Consequently, the code that ultimately runs can change after the Skill has been reviewed. Compromise of the remote service, its deployment pipeline, or the applicable DNS/TLS trust path could cause arbitrary shell commands to be returned and executed.

Bun may be needed by the subsequent build operation, but executing a mutable remote response through curl | bash is not the minimum privilege or minimum-risk installation mechanism necessary for the Skill's documentation-querying purpose.

Attack Path

1. Bun is absent from the user's environment.
2. The user or agent follows the setup instructions in SKILL.md.
3. The shell evaluates the fallback after bun --version fails.
4. curl retrieves a mutable script from the external endpoint.
5. The response is streamed directly into Bash without integrity verification or review.
6. A malicious or compromised response executes arbitrary commands with the permissions of the invoking user.

Impact Assessment

A malicious response can obtain the invoking user's privileges and access files, environment variables, credentials, and network resources available to that account. It could modify shell configuration, install additional software, or establish persistence, although the reviewed Skill does not itself explicitly instruct the installer to perform those actions.

If Context7 credentials are already ...[truncated 261 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | bash installation instruction.
• Declare Bun as an explicit prerequisite and direct users to an approved package manager or official manual installation process.
• Pin Bun to a reviewed version.
• Download the installer or release artifact separately, verify its published cryptographic signature or SHA-256 checksum, and only then execute or install it.
• Avoid automatic installation during Skill execution; require explicit user approval before changing the local development environment.
• Run installation with ordinary user privileges and do not request sudo or administrator access.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:11

Finding

Unpinned Third-Party Tooling and GitHub Source Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-20
Vulnerability Type: Unpinned executable dependencies and mutable source installation
Risk Level: High

Vulnerable Code:

bash

If `context7-cli` is not installed, install it from GitHub:
```bash
npx api2cli install Melvynx/context7-cli

If context7-cli is not found, install and build it:

bash

bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle context7
npx api2cli link context7

text

### Technical Analysis

The `api2cli` package is invoked through `npx` without an exact version or integrity constraint. If it is not already available locally, `npx` may retrieve the current package release and execute its package code. The effective dependency can therefore differ from the version that existed when this Skill was audited.

The GitHub source reference `Melvynx/context7-cli` is also not pinned to a reviewed commit hash or signed release. A compromised package-registry account, GitHub maintainer account, repository, or upstream release process could substitute attacker-controlled code.

The subsequent `bundle` and `link` operations process and expose the installed CLI. The documentation also states that linking adds `~/.local/bin` to `PATH`, representing a persistent change to the user's shell environment. While linking a CLI may be operationally useful, automatic PATH modification should be disclosed and approved, and it does not remove the dependency-integrity risk.

### Attack Path

1. The user or agent follows the setup instructions because `context7-cli` is unavailable.
2. `npx` resolves an unpinned version of `api2cli`, potentially downloading it from the package registry.
3. Registry-distributed package code executes with the invoking user's permissions.
4. `api2cli` obtains or processes the unpinned GitHub project.
5. A compromised upstream package or repository supplies malicious code.
6. 
...[truncated 961 chars]

Remediation

View remediation

Remediation Suggestions

• Pin api2cli to an exact reviewed version, for example through an explicit version-qualified invocation and a lockfile with integrity metadata.
• Pin Melvynx/context7-cli to a specific audited commit hash or cryptographically signed release rather than a mutable repository reference.
• Verify package integrity, release signatures, provenance attestations, and maintainer identity before installation.
• Prefer a reviewed local dependency installation over automatically downloading and executing packages through npx.
• Document every file and shell configuration change made by api2cli link.
• Require explicit user consent before adding ~/.local/bin to PATH.
• Avoid installation during ordinary Skill use; separate trusted setup from documentation-query operations.
• Execute the CLI under ordinary user privileges and restrict access to unrelated credentials and sensitive environment variables.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

curl -fsSL https://bun.sh/install | bash fetches a remote script and immediately executes it in the shell, which is a classic high-risk pattern. If the remote host, transport path, or delivered script is compromised, arbitrary code will run on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

If context7-cli is not found, install and build it:

bash

bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle context7
npx api2cli link context7

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | bash pipeline chains network retrieval directly into command execution, removing any opportunity to inspect the downloaded content first. In this skill context, the command appears as routine setup guidance, which makes unsafe execution more likely and increases the chance of silent compromise.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

If context7-cli is not found, install and build it:

bash

bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle context7
npx api2cli link context7

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The skill instructs users to run npx api2cli install Melvynx/context7-cli without pinning a specific package version. This creates a supply-chain risk because future package changes or a compromised dependency could cause different code to be fetched and executed than what was originally reviewed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes installation steps that execute shell commands, install tooling, and modify PATH behavior, but does not clearly warn users about system changes or security implications. This can lead users or downstream agents to make privileged environment changes without informed consent or review.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The command npx api2cli bundle context7 relies on an unpinned api2cli tool version. Because npx resolves packages dynamically, the behavior and code executed may change over time, exposing users to unintended or malicious upstream updates.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The command npx api2cli link context7 also invokes an unpinned package via npx, which can execute arbitrary updated package code at runtime. In a skill that tells users to install and link tooling automatically, this increases supply-chain exposure.

Content

No source excerpt is available for this finding.