find-docs
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx ctx7@latestto execute commands. This fetches the latest version of thectx7package from the official npm registry (npmjs.com). This is a standard practice for ensuring the latest CLI features and bug fixes are used without requiring a global installation. - [COMMAND_EXECUTION]: The skill instructs the agent to run shell commands (
npx ctx7@latest library ...andnpx ctx7@latest docs ...). These commands are scoped to documentation retrieval and do not interact with sensitive system files or administrative privileges. - [CREDENTIALS_UNSAFE]: The documentation mentions an optional
CONTEXT7_API_KEYenvironment variable and annpx ctx7@latest logincommand for higher rate limits. It explicitly warns users NOT to include sensitive information like API keys or passwords in documentation queries, promoting secure usage of the tool. - [INDIRECT_PROMPT_INJECTION]: The skill processes external documentation data. While it includes warnings to ignore embedded instructions (standard for LLM documentation skills), it uses the data primarily for information retrieval, and the
ctx7tool does not have high-privilege capabilities that would lead to escalation.
Audit Metadata