ClawHub
Back to skill

Security audit

Context7 MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Context7 documentation-query CLI, with ordinary API-key and network use plus some dependency hygiene issues.

Before installing, prefer deterministic installs from the included lockfile, review or remove unused dependencies, and keep the Context7 API key scoped to this service. Expect your library names and search queries to be sent to Context7 when you run the commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
package.json:10
Finding

Unnecessary npm dependencies expand the installation-time supply-chain attack surface

Content
View full analysis

Vulnerability Details

File Location: skill.md:36-39, package.json:10-17, package-lock.json:784-788, package-lock.json:981-985
Vulnerability Type: Unnecessary third-party dependencies and installation scripts
Risk Level: Low

Relevant Code

skill.md:36-39 instructs users to install the complete dependency graph:

bash
npm install

package.json:10-17 declares runtime packages that are not imported or used by query.ts:

json
"dependencies": {
  "mcp-client": "^1.13.1",
  "zod": "^3.22.4"
},
"devDependencies": {
  "@types/node": "^20.10.0",
  "tsx": "^4.6.0",
  "typescript": "^5.3.0"
}

The lockfile additionally marks the transitive esbuild and fsevents packages as having installation scripts at package-lock.json:784-788 and package-lock.json:981-985.

Technical Analysis

The implemented CLI uses Node.js built-in modules and global fetch; it does not import mcp-client or zod. Requiring users to install these unused packages and their transitive dependency trees exceeds the minimum dependency set necessary for the declared REST API functionality.

npm lifecycle and installation scripts execute with the privileges of the user running npm. Although the audited lockfile resolves packages from the official npm registry and no currently locked dependency was demonstrated to be malicious, every unnecessary dependency increases exposure to future package-account compromise, malicious updates, or compromised transitive packages. The presence of installation scripts makes this exposure more consequential because package code can run during installation, before the Skill itself is invoked.

This is a supply-chain hardening issue rather than evidence of active malicious behavior in the current package set.

Attack Path

  1. An attacker compromises an unnecessary direct or transitive npm package, or publishes a malicious version accepted by a future dependenc ...[truncated 1023 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove mcp-client and zod unless they are required by functionality not present in the audited project.
  2. Regenerate package-lock.json after removing unused packages to eliminate their transitive dependency trees.
  3. Prefer npm ci over npm install for reproducible installation from the reviewed lockfile.
  4. Where operationally compatible, use npm ci --ignore-scripts and explicitly allow only installation scripts that are required.
  5. Pin dependency versions, review lockfile changes, and run dependency auditing in CI.
  6. Avoid exposing unrelated secrets in the environment used for dependency installation.
  7. Remove or correct the read and explore package scripts because their referenced source files are absent, reducing configuration ambiguity.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill metadata/file declares no permissions, yet static analysis detected capabilities consistent with environment access and network use. That mismatch is a real security concern because it prevents informed consent and review, and a documentation-search skill with hidden env/network access could exfiltrate secrets or retrieve untrusted remote content without clear disclosure.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency uses a caret range (^1.13.1), which permits automatic installation of newer minor/patch releases. This can introduce supply-chain risk if a future upstream release is compromised or introduces breaking/security-relevant behavior without this project explicitly reviewing and pinning it.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json
"explore": "tsx explore.ts"
  },
  "dependencies": {
    "mcp-client": "^1.13.1",
    "zod": "^3.22.4"
  },
  "devDependencies": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The zod dependency is specified with a caret range, allowing resolution to newer releases than the one originally tested. In a documentation-query CLI, this still creates a supply-chain exposure because installation may pull in unreviewed upstream code over time.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json
},
  "dependencies": {
    "mcp-client": "^1.13.1",
    "zod": "^3.22.4"
  },
  "devDependencies": {
    "@types/node": "^20.10.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

The devDependency @types/node is also unpinned, which can affect build and development reproducibility. While its runtime security impact is lower than a production dependency, unreviewed changes in the toolchain can still disrupt builds or mask issues and are part of broader supply-chain hygiene.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json
"zod": "^3.22.4"
  },
  "devDependencies": {
    "@types/node": "^20.10.0",
    "tsx": "^4.6.0",
    "typescript": "^5.3.0"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The tsx devDependency is unpinned and is directly used to execute project scripts, so changes in resolved versions can alter local execution behavior. Although primarily a development-time risk, compromised or unexpected upstream updates could affect maintainers or CI environments running these scripts.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json
},
  "devDependencies": {
    "@types/node": "^20.10.0",
    "tsx": "^4.6.0",
    "typescript": "^5.3.0"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

The typescript devDependency is specified as a caret range, allowing unreviewed compiler updates. This is mainly a build-chain integrity concern rather than a direct runtime flaw, but deterministic builds are important for preventing unexpected behavior and reducing supply-chain exposure.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json
"devDependencies": {
    "@types/node": "^20.10.0",
    "tsx": "^4.6.0",
    "typescript": "^5.3.0"
  }
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
query.ts:23