Morrow Context7

Look up current, accurate documentation and code examples for any library or framework using context7-mcp. Use when an agent needs to know how to use a libra...

This skill appears to do what it says (fetch live docs) and needs only npx, but it will execute an npm package at runtime. Running `npx -y @upstash/context7-mcp` downloads and runs code from the registry each time — verify the package and publisher before use. Steps to reduce risk: - Check the npm package page and repository for @upstash/context7-mcp and confirm ownership and recent activity. - Verify that context7.com and the npm package are owned/endorsed by the same party (or by a trusted partner like Upstash). - If possible, inspect the package source code (or pin to a specific vetted version) rather than running with `-y` which auto-accepts the latest. - Run the tool in an isolated environment (sandbox/container) when first testing. - Be cautious about sending sensitive project code or secrets to the tool; it queries remote servers and will transmit your query. If you can't verify the package provenance or are uncomfortable with on-demand npm execution, treat this skill as untrusted until the upstream code and ownership are confirmed.

Type: OpenClaw Skill Name: morrow-context7 Version: 1.0.0 The skill provides a legitimate interface for the context7-mcp server to fetch library documentation and prevent AI hallucinations. It utilizes the '@upstash/context7-mcp' package via npx, which is a standard method for running Model Context Protocol (MCP) servers. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found in SKILL.md or _meta.json.