context7-cli
Pass
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for installing the
ctx7CLI tool globally usingnpm install -g ctx7or running it vianpx ctx7. It details commands for skill discovery, installation, and generation. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download and installation of AI coding skills from the Context7 registry (
context7.com). These downloads are the primary purpose of the skill and are directed to the vendor's official infrastructure. - [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection through the ingestion of external registry data.
- Ingestion points: Content is fetched from
context7.comvia search and install commands inSKILL.md. - Boundary markers: No explicit delimiters are mentioned for the content retrieved from the registry.
- Capability inventory: The CLI writes files to assistant-specific directories such as
.claude/skills/and.cursor/skills/. - Sanitization: The instructions do not specify a validation or sanitization process for the downloaded skills.
Audit Metadata