Fetch up-to-date library documentation via Context7 API. Use PROACTIVELY when: (1) Working with ANY external library (React, Next.js, Supabase, etc.) (2) User asks about library APIs, patterns, or best practices (3) Implementing features that rely on third-party packages (4) Debugging library-specific issues (5) Need current documentation beyond training data cutoff Always prefer this over guessing library APIs or using outdated knowledge.

This skill appears to be what it says (a Context7 API client), but it has two issues you should consider before installing or using it: - Hardcoded API key: The script contains a default API key baked into source. That key could be shared, revoked, or abused. Do not assume it's safe to use — prefer to set your own CONTEXT7_API_KEY in your environment and remove the embedded key from the copy you run. - Undeclared credential requirement: The skill metadata and SKILL.md do not mention the required CONTEXT7_API_KEY. Ask the publisher: who owns the default key and should you be using it? Ideally the skill should require you to provide your own key and document how to obtain it. - Data exposure: The script sends queries and potentially code/queries to an external service (context7.com). Avoid sending sensitive secrets or full source files in queries. Review Context7's privacy policy and ensure you trust the endpoint before sending proprietary code or credentials. Recommended actions: 1) Request the skill author to remove the hardcoded key and update SKILL.md to declare CONTEXT7_API_KEY as required and explain how to get one. 2) If you must use the skill now, set CONTEXT7_API_KEY in your environment to a key you control and sanitize any queries to avoid leaking secrets. 3) If you cannot verify the origin/ownership of the embedded key or the service, do not use the default key and consider not installing the skill until the author provides clarification.

Type: OpenClaw Skill Name: context7-api Version: 1.0.0 The skill is classified as suspicious due to the hardcoded API key found in `scripts/context7.py`. While the script's primary function is to fetch documentation from context7.com, the inclusion of a default API key (`ctx7sk-d6069954-149e-4a74-ae8f-85092cbfcd6f`) directly in the source code is a poor security practice and constitutes an information exposure, even if the key's specific permissions are unknown. This is a risky capability without clear malicious intent, but it prevents a benign classification.