·
Last changedVersion:
This version passed the hardening gate. Hardening applied 3 targeted changes and preserved all other text. Classified findings before hardening: 4. Classified findings closed: 2. Classified findings remaining: 2. Unclassified scanner findings remaining: 0. Review findings closed: 4. Review findings remaining: 10.
1
3
1
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
SKILL.md | Malicious Code & Command Execution | — | Low | Closed | |
SKILL.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Closed | |
SKILL.md | Prompt Injection | — | Low | Open |
4 findings
Retrieve current documentation and code examples for any library using the Context7 CLI.
Run commands with npx ctx7@latest so setup always uses the latest CLI without a global install:
Two-step process: resolve the library name to an ID, then query docs with that ID.
You MUST call library first to obtain a valid library ID UNLESS the user explicitly provides a library ID in the format /org/project or /org/project/version.
IMPORTANT: Do not run these commands more than 3 times per question. If you cannot find what you need after 3 attempts, use the best result you have.
Resolves a package/product name to a Context7-compatible library ID and returns matching libraries.
Use the official library name with proper punctuation (e.g., "Next.js" not "nextjs", "Customer.io" not "customerio", "Three.js" not "threejs"). If results look wrong, try alternate spellings such as next.js before changing the query.
Always pass a query argument — it is required and directly affects result ranking. Use the user's intent to form the query, which helps disambiguate when multiple libraries share a similar name. Do not include any sensitive or confidential information such as API keys, passwords, credentials, personal data, or proprietary code in your query.
Each result includes:
/org/project)/org/project/version.If the user mentions a specific version, use a version-specific library ID:
The available versions are listed in the library command output. Use the closest match to what the user specified.
Retrieves up-to-date documentation and code examples for the resolved library.
If you know the programming language the user writes in, add --language so code examples in that language rank first:
The query directly affects the quality of results. Be specific and include relevant details, but keep each query to one topic — if the question spans multiple distinct concepts, run a separate docs command per concept instead of combining them, unless the question is about how the concepts interact. Do not include any sensitive or confidential information such as API keys, passwords, credentials, personal data, or proprietary code in your query.
| Quality | Example |
|---|---|
Good |
|
Good |
|
Bad (too vague) |
|
Bad (too vague) |
|
Bad (too broad) |
|
Describe what to look up in the library's documentation, rather than the task to complete — vague one-word queries return generic results, and multi-topic queries dilute ranking and return shallow results for each topic.
The output contains two types of content: code snippets (titled, with language-tagged blocks) and info snippets (prose explanations with breadcrumb context).
Works without authentication. For higher rate limits:
If a command fails with a quota error ("Monthly quota reached" or "quota exceeded"):
npx ctx7@latest loginDo not silently fall back to training data — always tell the user why Context7 was not used.
/ prefix — /facebook/react not facebook/reactnpx ctx7@latest library first — npx ctx7@latest docs react "hooks" will fail without a valid ID"React useEffect cleanup function" not "hooks""routing and auth and caching" into a separate docs command per concept, unless the question is about how they interactGet started with chainctlchainctl skill install public/upstash/find-docs:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/upstash/skills/find-docs:latest
MIT
HARDENING.md
LICENSE
SKILL.md