Morrow Context7

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:18 AM UTC
• Version: 1.0.0

Overview

This documentation-lookup skill is coherent and not deceptive, but it asks users to run an unpinned third-party MCP package through npx, so the executed code can change after review.

Install only if you are comfortable allowing an npx-launched third-party MCP server to run with your user's local permissions. Prefer pinning `@upstash/context7-mcp` to a reviewed exact version, using a locked dependency workflow, and running it with restricted filesystem, credential, and network access where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:31

Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:31, SKILL.md:82, and SKILL.md:90
Vulnerability Type: Unpinned dependency execution
Risk Level: High

Vulnerable Code

At SKILL.md:31:

text

The server runs via `npx -y @upstash/context7-mcp` with no auth required.

At SKILL.md:82:

text

/mcp set context7="{\"command\":\"npx\",\"args\":[\"-y\",\"@upstash/context7-mcp\"]}"

At SKILL.md:90:

bash

  | npx -y @upstash/context7-mcp 2>/dev/null | grep '"name"'

Technical Analysis

The documented commands use npx -y to download and execute @upstash/context7-mcp without specifying an exact reviewed version or package integrity value. The -y option suppresses confirmation, while the absence of a version pin means the registry determines which release is executed at runtime.

Consequently, the effective executable can change after the Skill has been audited. If the package, its maintainer account, the package registry, or a transitive dependency is compromised, following these instructions can execute attacker-controlled JavaScript under the identity of the user running the agent.

The package name does not appear to be an obvious typo or dependency-confusion target based on the reviewed content. The vulnerability is the unsafe consumption of a mutable third-party dependency, not evidence that the current package version is malicious.

Attack Path

1. An attacker compromises the @upstash/context7-mcp publishing account, package release process, registry distribution path, or one of its executable dependencies.
2. The attacker publishes a malicious release that resolves under the unversioned package name.
3. An operator or agent follows the configuration or manual-testing instructions in SKILL.md.
4. npx -y retrieves the currently resolved package without requesting interactive approval.
5. Package installation lifecycle logic or MCP server startup code executes with the permissions of the invoking user.

...[truncated 1011 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version in every command and configuration example:

text

@upstash/context7-mcp@X.Y.Z

2. Keep the same exact version in the prose, OpenClaw MCP configuration, and manual-testing command so users do not accidentally invoke an unreviewed release.

3. Prefer installing the package through a controlled dependency workflow with a committed lockfile rather than downloading a mutable package at each invocation.

4. Verify package integrity through the package manager's lockfile integrity metadata or an independently validated checksum before execution.

5. Review package source, lifecycle scripts, and transitive dependency changes before updating the pinned version.

6. Where compatible with the package, disable unnecessary installation lifecycle scripts and execute the MCP server in a restricted environment with minimal filesystem, credential, and network access.

7. Document a deliberate upgrade process that includes security review and testing before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

MCP server references in the skill manifest without version pinning are a rug-pull risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad enough to activate on many ordinary library or configuration questions, which can cause unnecessary network/tool use and expand exposure to external content. In this skill's context, broader invocation increases the chance an agent fetches and trusts remote documentation snippets when a local answer would suffice, amplifying prompt-surface and operational risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs operators or agents to run npx -y @upstash/context7-mcp without pinning an exact package version. That permits whatever version is current at execution time to be fetched from the registry, creating supply-chain risk and making behavior non-reproducible if the package is updated maliciously or unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The manual testing command also executes @upstash/context7-mcp via npx without a version pin, so test runs will download and execute the latest published package. This exposes users performing validation to the same supply-chain and reproducibility risks as production usage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.