Is context7 safe to install?

SaferSkills independently audited context7 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

context7/SKILL.md · 1 file

context7/SKILL.md2.1 KB · Markdown

name: context7

description: |

Fetch up-to-date library documentation via Context7 API. Use PROACTIVELY when:

(1) Working with ANY external library (React, Next.js, Supabase, etc.)

(2) User asks about library APIs, patterns, or best practices

(3) Implementing features that rely on third-party packages

(4) Debugging library-specific issues

(5) Need current documentation beyond training data cutoff

(6) AND MOST IMPORTANTLY, when you are installing dependencies, libraries, or frameworks you should ALWAYS check the docs to see what the latest versions are. Do not rely on outdated knowledge.

Always prefer this over guessing library APIs or using outdated knowledge.

Context7 Documentation Fetcher

Retrieve current library documentation via Context7 API.

IMPORTANT: CONTEXT7_API_KEY IS STORED IN THE .env FILE IN THE SKILL FOLDER THAT THE CONTEXT7 SKILL IS INSTALLED IN. SEARCH FOR IT THERE. .env FILES ARE HIDDEN FILES.

Example: ~/.agents/skills/context7/.env ~/.claude/skills/context7/.env

Workflow

1. Search for the library

python3 ~/.codex/skills/context7/scripts/context7.py search "<library-name>"

Example:

python3 ~/.codex/skills/context7/scripts/context7.py search "next.js"

Returns library metadata including the id field needed for step 2.

2. Fetch documentation context

python3 ~/.codex/skills/context7/scripts/context7.py context "<library-id>" "<query>"

Example:

python3 ~/.codex/skills/context7/scripts/context7.py context "/vercel/next.js" "app router middleware"

Options:

--type txt|md - Output format (default: txt)
--tokens N - Limit response tokens

Quick Reference

Task	Command
Find React docs	`search "react"`
Get React hooks info	`context "/facebook/react" "useEffect cleanup"`
Find Supabase	`search "supabase"`
Get Supabase auth	`context "/supabase/supabase" "authentication row level security"`

When to Use

Before implementing any library-dependent feature
When unsure about current API signatures
For library version-specific behavior
To verify best practices and patterns

context7— agent skill

Is context7 safe to install?

Context7 Documentation Fetcher

Workflow

1. Search for the library

2. Fetch documentation context

Quick Reference

When to Use

Audit the pieces. Scan the whole. Decide.