v1.0.0

Morrow Context7

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:30 AM.

Analysis

This is a coherent documentation-lookup skill, with the main cautions being that it runs an external npm MCP server and sends lookup queries to Context7.

GuidanceThis skill appears reasonable for looking up current library documentation. Before installing, make sure you are comfortable running the external @upstash/context7-mcp package via npx and sending documentation query text to context7.com.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

The server runs via `npx -y @upstash/context7-mcp` with no auth required.

The executable component is an external npm package invoked without a pinned version. This is central to the skill's purpose and disclosed, but users are relying on the npm package source and future package contents.

User impactInstalling or configuring the skill may run code fetched through npm, so behavior depends on the external package remaining trustworthy.

RecommendationUse this only if you trust the @upstash/context7-mcp package; consider pinning a package version in local MCP configuration if reproducibility matters.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

context7-mcp is a Model Context Protocol (MCP) server that queries [context7.com](https://context7.com) for indexed documentation.

The skill uses an MCP server to send documentation lookup requests to an external service. This is expected for live documentation lookup, but query text may include details from the user's task.

User impactLibrary names and task-focused queries may leave the local environment and be processed by Context7.

RecommendationAvoid including secrets, proprietary code, or sensitive internal project details in documentation queries.