스킬 fetching-library-docs
📦
fetching-library-docs
콘텐츠 리비전 r1 높은 위험 🌐 네트워크 접근⚙️ 외부 명령어📁 파일 시스템 접근
Obtener documentación de API de bibliotecas
Los desarrolladores a menudo necesitan ejemplos actuales de API sin cargar la documentación completa en el contexto del modelo. Esta skill obtiene documentación de bibliotecas de Context7 y devuelve ejemplos, firmas y notas enfocadas.
지원: Claude Codex Code(CC)
설치 전에 중지하고 확인을 요청하세요.
계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.
내 에이전트로 설치
이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.
에이전트 요청
Review the Skillstore skill "fetching-library-docs" from https://skillstore.io/skills/asmayaseen-fetching-library-docs.md and its manifest at https://skillstore.io/api/skills/asmayaseen-fetching-library-docs/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.
에이전트가 읽기 쉬운 리소스
AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.
테스트해 보기
"fetching-library-docs" 사용 중입니다. Muéstrame ejemplos de React useState.
예상 결과:
Una respuesta concisa con ejemplos seleccionados de useState, firmas de API correspondientes y notas clave de la documentación actual de Context7.
"fetching-library-docs" 사용 중입니다. ¿Cómo funciona Next.js routing?
예상 결과:
Una breve descripción conceptual con algunos ejemplos de routing y conexiones entre los conceptos de routing relevantes.
"fetching-library-docs" 사용 중입니다. Encuentra la sintaxis de consultas de Prisma y advertencias importantes.
예상 결과:
Un resumen enfocado de métodos de consulta, ejemplos representativos y notas extraídas sobre uso seguro o recomendado.
보안 감사
높은 위험v11 • 2026. 7. 9. 버전별 보고서 열기
The skill has a legitimate purpose: fetching and filtering library documentation from Context7. Most static findings are false positives from markdown examples, awk output, and expected shell pipeline use, but the bundled generic MCP client exposes direct shell execution through --stdio, and the helper scripts use npx package execution plus predictable /tmp PID files.
11
스캔된 파일
1,364
분석된 줄 수
21
검토 항목
0
오탐 무시됨
확인된 보안 우려 사항 (3)
높음
User-Controlled Stdio Command Execution
The generic MCP client accepts a --stdio command and starts it with subprocess.Popen using shell=True. Direct use of scripts/mcp-client.py can execute arbitrary shell commands, even though the main skill workflow uses a fixed Context7 command.
The command string comes from the --stdio argument and is passed to Popen with shell=True. This is a direct local command execution path when the helper is used outside the fixed wrapper scripts.
중간
Automatic Package Execution with npx
The skill starts Context7 by running npx -y @upstash/context7-mcp. This downloads or executes a package during skill use, which creates supply-chain and network execution risk if the package source is compromised.
The scripts explicitly use npx -y to execute the Context7 MCP package. This appears intentional, but it is still a real external package execution risk.
중간
Predictable PID File Can Target Local Processes
The start and stop scripts store a process id in /tmp/context7-mcp-${PORT}.pid and later pass that value to kill. A stale or tampered PID file could cause the stop script to terminate an unrelated local process.
The PID file path is predictable and located in /tmp, and stop-server.sh trusts its contents. The impact is local process termination rather than data theft.
기능 검토 항목 (21)
이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.
높음
Python subprocess.Popen
self._process = subprocess.Popen(
subprocess.Popen starts the user-supplied --stdio command with shell=True. Direct use of the helper can execute arbitrary local shell commands.
중간
Shell command substitution
if [ -f "$PID_FILE" ] && kill -0 $(cat "$PID_FILE") 2>/dev/null; then
The script reads a PID from a predictable /tmp file and uses it in process checks or status output. This is local operational risk if the PID file is stale or tampered.
중간
Shell command substitution
echo "Context7 MCP already running on port $PORT (PID: $(cat $PID_FILE))"
The script reads a PID from a predictable /tmp file and uses it in process checks or status output. This is local operational risk if the PID file is stale or tampered.
중간
Shell command substitution
if kill -0 $(cat "$PID_FILE") 2>/dev/null; then
The script reads a PID from a predictable /tmp file and uses it in process checks or status output. This is local operational risk if the PID file is stale or tampered.
중간
Shell command substitution
echo "Context7 MCP started on port $PORT (PID: $(cat $PID_FILE))"
The script reads a PID from a predictable /tmp file and uses it in process checks or status output. This is local operational risk if the PID file is stale or tampered.
중간
Temp directory access
PID_FILE="/tmp/context7-mcp-${PORT}.pid"
The script writes a predictable PID file under /tmp. This can be tampered with by local users and affects later process-control decisions.
중간
Shell command substitution
PID=$(cat "$PID_FILE")
The script trusts a PID read from a predictable /tmp file before terminating a process. A tampered PID file could target an unrelated local process.
중간
Standard device file access
kill "$PID" 2>/dev/null
The stop script uses a predictable /tmp PID file or process-name matching to terminate local processes. This creates local process-control risk.
중간
Standard device file access
kill -9 "$PID" 2>/dev/null || true
The stop script uses a predictable /tmp PID file or process-name matching to terminate local processes. This creates local process-control risk.
중간
Standard device file access
pkill -f "context7-mcp.*--port.*${PORT}" 2>/dev/null && echo "Context7 MCP stopped" || echo "Context
The stop script uses a predictable /tmp PID file or process-name matching to terminate local processes. This creates local process-control risk.
중간
Temp directory access
PID_FILE="/tmp/context7-mcp-${PORT}.pid"
The stop script uses a predictable /tmp PID file or process-name matching to terminate local processes. This creates local process-control risk.
낮음
HTTP client library
def request(self, method: str, params: Optional[dict] = None) -> dict:
The MCP client can send JSON-RPC requests to a user-provided HTTP MCP endpoint. This is expected functionality, but it is still a real network data path.
낮음
HTTP client library
def request(self, method: str, params: Optional[dict] = None) -> dict:
The MCP client can send JSON-RPC requests to a user-provided HTTP MCP endpoint. This is expected functionality, but it is still a real network data path.
낮음
HTTP client library
result = self.transport.request("tools/list")
The MCP client can send JSON-RPC requests to a user-provided HTTP MCP endpoint. This is expected functionality, but it is still a real network data path.
낮음
HTTP client library
result = self.transport.request("tools/call", params)
The MCP client can send JSON-RPC requests to a user-provided HTTP MCP endpoint. This is expected functionality, but it is still a real network data path.
낮음
HTTP client library
result = self.transport.request("resources/list")
The MCP client can send JSON-RPC requests to a user-provided HTTP MCP endpoint. This is expected functionality, but it is still a real network data path.
낮음
HTTP client library
result = self.transport.request("prompts/list")
The MCP client can send JSON-RPC requests to a user-provided HTTP MCP endpoint. This is expected functionality, but it is still a real network data path.
낮음
Python HTTP libraries
from urllib.request import Request, urlopen
The MCP client can send JSON-RPC requests to a user-provided HTTP MCP endpoint. This is expected functionality, but it is still a real network data path.
낮음
Standard device file access
if [ -f "$PID_FILE" ] && kill -0 $(cat "$PID_FILE") 2>/dev/null; then
The script reads the PID file while checking process status. This is low local risk tied to the predictable /tmp PID file.
낮음
Standard device file access
if kill -0 $(cat "$PID_FILE") 2>/dev/null; then
The script reads the PID file while checking process status. This is low local risk tied to the predictable /tmp PID file.
낮음
Standard device file access
if kill -0 "$PID" 2>/dev/null; then
The script reads and checks process IDs from a local PID file. This is expected behavior but still part of the local process-control surface.
위험 요인
🌐 네트워크 접근 (13)
references/context7-tools.md:169 scripts/mcp-client.py:146 scripts/mcp-client.py:271 scripts/mcp-client.py:314 scripts/mcp-client.py:323 scripts/mcp-client.py:328 scripts/mcp-client.py:333 scripts/mcp-client.py:33 scripts/mcp-client.py:10 scripts/mcp-client.py:16 scripts/mcp-client.py:20 scripts/mcp-client.py:23 SKILL.md:221
⚙️ 외부 명령어 (50)
scripts/extract-code-blocks.sh:9-18 scripts/extract-code-blocks.sh:18-25 scripts/extract-code-blocks.sh:25-27 scripts/extract-code-blocks.sh:27-30 scripts/extract-code-blocks.sh:30-38 scripts/extract-code-blocks.sh:1 scripts/extract-notes.sh:1 scripts/extract-signatures.sh:16 scripts/extract-signatures.sh:30 scripts/extract-signatures.sh:38 scripts/extract-signatures.sh:1 scripts/fetch-docs.sh:11 scripts/fetch-docs.sh:93-96 scripts/fetch-docs.sh:100 scripts/fetch-docs.sh:102 scripts/fetch-docs.sh:106 scripts/fetch-docs.sh:120 scripts/fetch-docs.sh:124 scripts/fetch-docs.sh:126 scripts/fetch-docs.sh:136 scripts/fetch-docs.sh:137 scripts/fetch-docs.sh:150 scripts/fetch-docs.sh:157 scripts/fetch-docs.sh:167 scripts/fetch-docs.sh:174-175 scripts/fetch-docs.sh:183 scripts/fetch-docs.sh:191 scripts/fetch-docs.sh:200 scripts/fetch-docs.sh:201 scripts/fetch-docs.sh:202 scripts/fetch-docs.sh:1 scripts/fetch-raw.sh:13-19 scripts/fetch-raw.sh:23-31 scripts/fetch-raw.sh:35 scripts/fetch-raw.sh:1 scripts/mcp-client.py:191 scripts/mcp-client.py:204 scripts/mcp-client.py:348 scripts/mcp-client.py:371 scripts/mcp-client.py:377-379 scripts/start-server.sh:9 scripts/start-server.sh:10 scripts/start-server.sh:20 scripts/start-server.sh:21 scripts/start-server.sh:1 scripts/stop-server.sh:9 scripts/stop-server.sh:1 SKILL.md:20-28 SKILL.md:28-44 SKILL.md:44-46
📁 파일 시스템 접근 (12)
scripts/fetch-docs.sh:96 scripts/fetch-docs.sh:99 scripts/fetch-docs.sh:123 scripts/fetch-raw.sh:38 scripts/start-server.sh:9 scripts/start-server.sh:20 scripts/start-server.sh:6 scripts/stop-server.sh:10 scripts/stop-server.sh:12 scripts/stop-server.sh:16 scripts/stop-server.sh:25 scripts/stop-server.sh:6
감사자: claude 감사 이력 보기 →
이 보고서 공유 및 인용
버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.
보고서 링크 복사
https://skillstore.io/skills/asmayaseen-fetching-library-docs/audits/11?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 배지
[](https://skillstore.io/skills/asmayaseen-fetching-library-docs?utm_source=security_passport_badge)HTML 배지
<a href="https://skillstore.io/skills/asmayaseen-fetching-library-docs?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/asmayaseen-fetching-library-docs/security.svg" alt="Skillstore security assessment" loading="lazy"></a>임베드 카드
<iframe src="https://skillstore.io/embed/skills/asmayaseen-fetching-library-docs.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>학술 인용 (APA · BibTeX · CFF)
APA 인용
Asmayaseen. (2026). fetching-library-docs security audit report (audit version 11) [Author version unspecified]. Skillstore. https://skillstore.io/skills/asmayaseen-fetching-library-docs/audits/11BibTeX 인용
@techreport{asmayaseen-asmayaseen-fetching-library-docs-2026,
author = {Asmayaseen},
title = {fetching-library-docs security audit report (audit version 11)},
institution = {Skillstore},
year = {2026},
number = {11},
url = {https://skillstore.io/skills/asmayaseen-fetching-library-docs/audits/11},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "fetching-library-docs security audit report (audit version 11)"
version: "unspecified"
type: report
authors:
- name: "Asmayaseen"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/asmayaseen-fetching-library-docs/audits/11"
identifiers:
- type: other
value: "skillstore:asmayaseen-fetching-library-docs:audit:11"
description: "Skillstore immutable audit report identifier"
Skillstore 점수
이 점수의 이유 증거 신뢰도: 중간 64
아키텍처
85
유지보수성
85
콘텐츠
70
커뮤니티
83
사양 준수
만들 수 있는 것
Consultar APIs de frameworks
Obtén ejemplos enfocados para React hooks, Next.js routing, Prisma queries o características similares de frameworks.
Aprender una biblioteca desconocida
Empieza con documentación conceptual y luego solicita ejemplos de código para el mismo paquete o característica.
Reducir el tamaño del contexto de documentación
Usa filtrado de shell para mantener respuestas de documentación grandes fuera del contexto del modelo.
이 프롬프트를 사용해 보세요
Obtener un ejemplo simple de API
Obtén la documentación actual para React useState y muestra los ejemplos más relevantes.
Comparar patrones de uso
Usa la skill de documentación de bibliotecas para encontrar ejemplos de Next.js routing y luego resume los patrones principales.
Aprender el flujo de trabajo de un paquete
Obtén primero información de introducción de Prisma, luego obtén ejemplos de consultas y explica el flujo de trabajo.
Investigar varias páginas
Obtén documentación de React hooks en las dos primeras páginas, luego identifica patrones avanzados y advertencias importantes.
모범 사례
- Usa un nombre de biblioteca y un tema específicos para obtener resultados enfocados.
- Usa el modo de código para ejemplos de API y el modo de información para conceptos.
- Usa un ID de biblioteca conocido de Context7 cuando ya tengas uno.
피하기
- No uses esta skill para inspeccionar archivos de repositorios locales.
- No solicites documentación de paquetes privados o no publicados mediante Context7.
- No omitas el script de obtención filtrada salvo que necesites depuración MCP sin procesar.
자주 묻는 질문
¿Esta skill funciona con Claude Code?
Sí. El informe indica soporte para Claude, Codex y Claude Code.
¿Qué fuente de documentación usa?
Usa el servidor Context7 MCP para resolver IDs de bibliotecas y obtener documentación.
¿Puede leer los archivos de mi proyecto local?
No. Está diseñada para documentación de bibliotecas publicadas, no para análisis de repositorios locales.
¿Por qué filtra la documentación?
El filtrado devuelve los ejemplos y notas más útiles mientras reduce el uso del contexto del modelo.
¿Puedo pedir explicaciones conceptuales?
Sí. Usa el modo de información cuando quieras conceptos, arquitectura u orientación narrativa.
¿Cuáles son las principales consideraciones de seguridad?
Usa acceso a la red, ejecución de paquetes en tiempo de ejecución, scripts de shell y un auxiliar MCP genérico que debería restringirse antes de la publicación.
개발자 세부 정보
작성자
Asmayaseen라이선스
MIT
Skillstore 리비전
r1
버전 안내
작성자가 버전을 선언하지 않았습니다.
참조
1ffa7643651792ccb4bd3b15d924d2c97edff755
유지보수 최신성
2026. 7. 18.
사용량
7 다운로드 · 218 조회