56 results available
Sign in
Skills directory

find-docs

upstash

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 3 targeted changes and preserved all other text. Classified findings before hardening: 4. Classified findings closed: 2. Classified findings remaining: 2. Unclassified scanner findings remaining: 0. Review findings closed: 4. Review findings remaining: 10.


Open before hardening

1

Medium

3

Low
Open after hardening

1

Medium

1

Low

Expand
File
Group
Subtype
Severity
Status
SKILL.md

Supply Chain & Install-Time Trust

—

Medium
Open
SKILL.md

Malicious Code & Command Execution

—

Low
Closed
SKILL.md

Supply Chain & Install-Time Trust

Install-time download and execute

Low
Closed
SKILL.md

Prompt Injection

—

Low
Open

4 findings


SKILL.md

Documentation Lookup

Retrieve current documentation and code examples for any library using the Context7 CLI.

Run commands with npx ctx7@latest so setup always uses the latest CLI without a global install:

npx ctx7@latest library <name> "<query>"
npx ctx7@latest docs <libraryId> "<query>"

Workflow

Two-step process: resolve the library name to an ID, then query docs with that ID.

# Step 1: Resolve library ID
npx ctx7@latest library <name> "<query>"

# Step 2: Query documentation
npx ctx7@latest docs <libraryId> "<query>"

You MUST call library first to obtain a valid library ID UNLESS the user explicitly provides a library ID in the format /org/project or /org/project/version.

IMPORTANT: Do not run these commands more than 3 times per question. If you cannot find what you need after 3 attempts, use the best result you have.

Step 1: Resolve a Library

Resolves a package/product name to a Context7-compatible library ID and returns matching libraries.

npx ctx7@latest library React "How to clean up useEffect with async operations"
npx ctx7@latest library "Next.js" "How to set up app router with a proxy"
npx ctx7@latest library Prisma "How to define one-to-many relations with cascade delete"

Use the official library name with proper punctuation (e.g., "Next.js" not "nextjs", "Customer.io" not "customerio", "Three.js" not "threejs"). If results look wrong, try alternate spellings such as next.js before changing the query.

Always pass a query argument — it is required and directly affects result ranking. Use the user's intent to form the query, which helps disambiguate when multiple libraries share a similar name. Do not include any sensitive or confidential information such as API keys, passwords, credentials, personal data, or proprietary code in your query.

Result fields

Each result includes:

  • Library ID — Context7-compatible identifier (format: /org/project)
  • Name — Library or package name
  • Description — Short summary
  • Code Snippets — Number of available code examples
  • Source Reputation — Authority indicator (High, Medium, Low, or Unknown)
  • Benchmark Score — Quality indicator (100 is the highest score)
  • Versions — List of versions if available. Use one of those versions if the user provides a version in their query. The format is /org/project/version.

Selection process

  1. Analyze the query to understand what library/package the user is looking for
  2. Select the most relevant match based on:
    • Name similarity to the query (exact matches prioritized)
    • Description relevance to the query's intent
    • Documentation coverage (prioritize libraries with higher Code Snippet counts)
    • Source reputation (consider libraries with High or Medium reputation more authoritative)
    • Benchmark score (higher is better, 100 is the maximum)
  3. If multiple good matches exist, acknowledge this but proceed with the most relevant one
  4. If no good matches exist, clearly state this and suggest query refinements
  5. For ambiguous queries, request clarification before proceeding with a best-guess match

Version-specific IDs

If the user mentions a specific version, use a version-specific library ID:

# General (latest indexed)
npx ctx7@latest docs /vercel/next.js "How to set up app router"

# Version-specific
npx ctx7@latest docs /vercel/next.js/v16.2.9 "How to set up app router"

The available versions are listed in the library command output. Use the closest match to what the user specified.

Step 2: Query Documentation

Retrieves up-to-date documentation and code examples for the resolved library.

npx ctx7@latest docs /facebook/react "How to clean up useEffect with async operations"
npx ctx7@latest docs /vercel/next.js "How to add an authentication proxy to app router"
npx ctx7@latest docs /prisma/prisma "How to define one-to-many relations with cascade delete"

If you know the programming language the user writes in, add --language so code examples in that language rank first:

npx ctx7@latest docs /websites/twilio "How to send an SMS" --language Ruby

Writing good queries

The query directly affects the quality of results. Be specific and include relevant details, but keep each query to one topic — if the question spans multiple distinct concepts, run a separate docs command per concept instead of combining them, unless the question is about how the concepts interact. Do not include any sensitive or confidential information such as API keys, passwords, credentials, personal data, or proprietary code in your query.

QualityExample

Good

"How to set up authentication with JWT in Express.js"

Good

"React useEffect cleanup function with async operations"

Bad (too vague)

"auth"

Bad (too vague)

"hooks"

Bad (too broad)

"routing and auth and caching in Next.js"

Describe what to look up in the library's documentation, rather than the task to complete — vague one-word queries return generic results, and multi-topic queries dilute ranking and return shallow results for each topic.

The output contains two types of content: code snippets (titled, with language-tagged blocks) and info snippets (prose explanations with breadcrumb context).

Authentication

Works without authentication. For higher rate limits:

# Option A: environment variable
export CONTEXT7_API_KEY=your_key

# Option B: OAuth login
npx ctx7@latest login

Error Handling

If a command fails with a quota error ("Monthly quota reached" or "quota exceeded"):

  1. Inform the user their Context7 quota is exhausted
  2. Suggest they authenticate for higher limits: npx ctx7@latest login
  3. If they cannot or choose not to authenticate, answer from training knowledge and clearly note it may be outdated

Do not silently fall back to training data — always tell the user why Context7 was not used.

Common Mistakes

  • Library IDs require a / prefix — /facebook/react not facebook/react
  • Always run npx ctx7@latest library first — npx ctx7@latest docs react "hooks" will fail without a valid ID
  • Use descriptive queries, not single words — "React useEffect cleanup function" not "hooks"
  • One topic per query — split "routing and auth and caching" into a separate docs command per concept, unless the question is about how they interact
  • Do not include sensitive information (API keys, passwords, credentials) in queries

Install

Install with chainctl
chainctl skill install public/upstash/find-docs:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/upstash/context7
Upstream commit615e72b018f2254d32bf49b5eff55d0e61a5cce5
OCI reference

skills.cgr.dev/public/github.com/upstash/skills/find-docs:latest

License

MIT

Files

HARDENING.md

LICENSE

SKILL.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.