This report is not translated for the requested language. The canonical English report is shown instead.
Versioned security assessment
Report ID: SA-EF19B01A
7/5/2026, 1:09:31 AM
context7-efficient security assessment v7
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- context7-efficient
- Version
- v7
- Maintainer
- AbdullahMalik17
- Coverage
- 10 Files scanned · 1,333 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
2 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The skill is a legitimate Context7 documentation helper, but it relies on local shell scripts, subprocess execution, and network-backed MCP access. Most markdown backtick and library-resolution findings are false positives, while the real risks are unpinned npx execution, shell-based process management, and a Python stdio transport that uses shell=True.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
10 Files scanned · 1,333 Lines analyzed
29 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 13 evidence locations
Filesystem access
May read or write local files.
Observed in 12 evidence locations
Env variables
May read values from the process environment.
Not recorded by this audit
External commands
May invoke commands or programs outside the Skill.
Observed in 88 evidence locations
Capability review items (27)
High
Python subprocess.Popen
self._process = subprocess.Popen(
This line starts a subprocess from a command string with shell=True. If the stdio command is influenced by a caller, it creates a command execution risk.
Medium
Shell command substitution
RESOLVE_JSON=$(python3 "$SCRIPT_DIR/mcp-client.py" call \
The main workflow executes local shell and Python helpers that invoke the Context7 MCP package through npx. This intended behavior expands the install-time trust boundary to external commands.
Medium
Shell command substitution
RAW_JSON=$("$SCRIPT_DIR/fetch-raw.sh" "$LIBRARY_ID" "$TOPIC" "$MODE" "$PAGE")
The main workflow executes local shell and Python helpers that invoke the Context7 MCP package through npx. This intended behavior expands the install-time trust boundary to external commands.
Medium
Unix shell invocation
#!/bin/bash
The main workflow executes local shell and Python helpers that invoke the Context7 MCP package through npx. This intended behavior expands the install-time trust boundary to external commands.
Medium
Shell command substitution
python3 "$(dirname "$0")/mcp-client.py" call \
This script invokes the Python MCP client, which starts the Context7 MCP package with npx. That is intentional external command execution and should be reviewed before install.
Medium
Unix shell invocation
#!/bin/bash
This script invokes the Python MCP client, which starts the Context7 MCP package with npx. That is intentional external command execution and should be reviewed before install.
Medium
Shell command substitution
if [ -f "$PID_FILE" ] && kill -0 $(cat "$PID_FILE") 2>/dev/null; then
The server helper executes npx and uses shell process checks with a PID file. This is real local command execution, even though it is part of the intended workflow.
Medium
Shell command substitution
echo "Context7 MCP already running on port $PORT (PID: $(cat $PID_FILE))"
The server helper executes npx and uses shell process checks with a PID file. This is real local command execution, even though it is part of the intended workflow.
Medium
Shell command substitution
if kill -0 $(cat "$PID_FILE") 2>/dev/null; then
The server helper executes npx and uses shell process checks with a PID file. This is real local command execution, even though it is part of the intended workflow.
Medium
Shell command substitution
echo "Context7 MCP started on port $PORT (PID: $(cat $PID_FILE))"
The server helper executes npx and uses shell process checks with a PID file. This is real local command execution, even though it is part of the intended workflow.
Medium
Unix shell invocation
#!/bin/bash
The server helper executes npx and uses shell process checks with a PID file. This is real local command execution, even though it is part of the intended workflow.
Medium
Temp directory access
PID_FILE="/tmp/context7-mcp-${PORT}.pid"
The script stores and trusts a predictable PID file under /tmp. A local user or stale file could influence process checks for the server helper.
Medium
Shell command substitution
PID=$(cat "$PID_FILE")
The stop helper executes shell process-management commands and reads a PID file. It can affect local processes and should be treated as a real operational risk.
Medium
Unix shell invocation
#!/bin/bash
The stop helper executes shell process-management commands and reads a PID file. It can affect local processes and should be treated as a real operational risk.
Medium
Standard device file access
kill "$PID" 2>/dev/null
The stop helper trusts a predictable /tmp PID file and can terminate processes based on that value or a broad match pattern. This creates a local denial-of-service risk.
Medium
Standard device file access
kill -9 "$PID" 2>/dev/null || true
The stop helper trusts a predictable /tmp PID file and can terminate processes based on that value or a broad match pattern. This creates a local denial-of-service risk.
Medium
Standard device file access
pkill -f "context7-mcp.*--port.*${PORT}" 2>/dev/null && echo "Context7 MCP stopped" || echo "Context
The stop helper trusts a predictable /tmp PID file and can terminate processes based on that value or a broad match pattern. This creates a local denial-of-service risk.
Medium
Temp directory access
PID_FILE="/tmp/context7-mcp-${PORT}.pid"
The stop helper trusts a predictable /tmp PID file and can terminate processes based on that value or a broad match pattern. This creates a local denial-of-service risk.
Low
HTTP client library
def request(self, method: str, params: Optional[dict] = None) -> dict:
The static finding did not match a reviewed safe pattern. Kept as confirmed with low confidence for fail-closed handling.
Low
HTTP client library
result = self.transport.request("tools/list")
The static finding did not match a reviewed safe pattern. Kept as confirmed with low confidence for fail-closed handling.
Low
HTTP client library
result = self.transport.request("tools/call", params)
The static finding did not match a reviewed safe pattern. Kept as confirmed with low confidence for fail-closed handling.
Low
HTTP client library
result = self.transport.request("resources/list")
The static finding did not match a reviewed safe pattern. Kept as confirmed with low confidence for fail-closed handling.
Low
HTTP client library
result = self.transport.request("prompts/list")
The static finding did not match a reviewed safe pattern. Kept as confirmed with low confidence for fail-closed handling.
Low
Python HTTP libraries
from urllib.request import Request, urlopen
The static finding did not match a reviewed safe pattern. Kept as confirmed with low confidence for fail-closed handling.
Low
Standard device file access
if [ -f "$PID_FILE" ] && kill -0 $(cat "$PID_FILE") 2>/dev/null; then
The script stores and trusts a predictable PID file under /tmp. A local user or stale file could influence process checks for the server helper.
Low
Standard device file access
if kill -0 $(cat "$PID_FILE") 2>/dev/null; then
The script stores and trusts a predictable PID file under /tmp. A local user or stale file could influence process checks for the server helper.
Low
Standard device file access
if kill -0 "$PID" 2>/dev/null; then
The stop helper trusts a predictable /tmp PID file and can terminate processes based on that value or a broad match pattern. This creates a local denial-of-service risk.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (2)
RISK-001 High
Unpinned NPX Package Execution
The scripts execute @upstash/context7-mcp through npx without a pinned version. A changed or compromised package release would run local code during documentation lookup.
The cited commands run npx -y @upstash/context7-mcp and do not specify a version. This is a clear supply-chain execution risk, although the package appears intended for the skill.
RISK-002 Medium
Broad Process Termination Helper
The stop script can force-kill the PID stored in a predictable temporary file and can use pkill with a pattern built from the port argument. This can terminate unintended local processes if the PID file or port value is unsafe.
The script reads /tmp/context7-mcp-${PORT}.pid, uses kill -9 on that PID, and falls back to pkill -f with the port value. The behavior is explicit process control, but impact is local.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighUnpinned npx execution of the Context7 MCP package.Pin @upstash/context7-mcp to a reviewed version or vendor a verified launcher, and document the expected package checksum or version.
- FIX-002HighPython stdio transport starts command strings with shell=True.Replace shell=True with an argument array, or restrict --stdio to an allowlist of reviewed commands.
- FIX-003MediumPID files are stored under a predictable /tmp path and are trusted by start and stop helpers.Use a private runtime directory, validate PID ownership and command name before killing, and avoid broad pkill patterns.
- FIX-004MediumShell scripts interpolate user values into JSON parameter strings.Build JSON parameters with jq, Python json.dumps, or another structured encoder to avoid malformed requests.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable