context7-auto-research
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION] (MEDIUM): The instructions in
SKILL.md(Step 2 and Step 4) direct the agent to execute a shell command via theTasktool using un-sanitized user input. By wrapping user-provided queries in double quotes inside a bash string (e.g.,node ... search "<library-name>" "<user-query>"), the skill is vulnerable to shell interpolation attacks. A malicious user could include characters like backticks or$(...)in their query to execute arbitrary code on the host system. - [PROMPT_INJECTION] (LOW): The skill is vulnerable to indirect prompt injection (Category 8). It ingests documentation from an external API (
context7.com) and incorporates it into the agent's context without sanitization or boundary markers. - Ingestion points: External data returned by
context7-api.jsin Step 4. - Boundary markers: Absent. The skill provides no instructions to treat the documentation as untrusted or to use delimiters.
- Capability inventory: The skill has access to
Bash,Write, andTasktools, which could be exploited if malicious instructions are present in the fetched documentation. - Sanitization: Absent. No filtering or escaping is performed on the retrieved text before it is presented to the agent.
Audit Metadata