{"record":{"id":"08ee8342eb00e160","repo":"upstash/context7","slug":"review-other-skills-from-this-repository-carefully","errorCode":null,"errorMessage":"Review other skills from this repository carefully before installing.","messagePattern":"Review other skills from this repository carefully before installing\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/cli/src/commands/skill.ts","lineNumber":327,"sourceCode":"    }\n\n    if (!data.skills || data.skills.length === 0) {\n      spinner.warn(pc.yellow(`No skills found in ${repo}`));\n      return;\n    }\n\n    const skillsWithRepo = data.skills\n      .map((s) => ({ ...s, project: repo }))\n      .sort((a, b) => (b.installCount ?? 0) - (a.installCount ?? 0));\n\n    spinner.succeed(`Found ${data.skills.length} skill(s)`);\n\n    if (data.blockedSkillsCount && data.blockedSkillsCount > 0) {\n      log.blank();\n      log.error(\n        `${data.blockedSkillsCount} skill(s) blocked due to prompt injection and not shown.`\n      );\n      log.warn(\"Review other skills from this repository carefully before installing.\");\n    }\n\n    if (options.all || data.skills.length === 1) {\n      selectedSkills = skillsWithRepo;\n    } else {\n      const indexWidth = data.skills.length.toString().length;\n      const maxNameLen = Math.max(...data.skills.map((s) => s.name.length));\n      const popularityColWidth = 13;\n      const choices = skillsWithRepo.map((s, index) => {\n        const indexStr = pc.dim(`${(index + 1).toString().padStart(indexWidth)}.`);\n        const paddedName = s.name.padEnd(maxNameLen);\n        const popularity = formatPopularity(s.installCount) + \" \".repeat(popularityColWidth - 4);\n        const trust = formatTrust(s.trustScore);\n\n        const skillUrl = s.url || `https://github.com${s.project}`;\n        const skillLink = terminalLink(s.name, skillUrl, pc.white);\n        const repoLink = terminalLink(s.project, `https://github.com${s.project}`, pc.white);\n        const metadataLines = [","sourceCodeStart":309,"sourceCodeEnd":345,"githubUrl":"https://github.com/upstash/context7/blob/5284672feb575908efead6fcf1b5e542f8d607bb/packages/cli/src/commands/skill.ts#L309-L345","documentation":"After successfully listing a repository's skills, the registry response includes blockedSkillsCount > 0 — skills removed from the listing because they matched prompt-injection patterns. The CLI prints an error stating N skill(s) were blocked and not shown, followed by this warning advising the user that the remaining skills from the same repository deserve extra scrutiny before install.","triggerScenarios":"Listing skills for a repository where at least one skill was filtered by server-side injection scanning; the command still succeeds and shows the unblocked skills, but this advisory is emitted right after the 'Found N skill(s)' success line.","commonSituations":"Community repositories with mixed quality where one malicious skill got the author flagged; users evaluating unfamiliar repos via `context7 skill add <repo>`.","solutions":["Read the source of each remaining skill on GitHub before installing anything from that repository.","Prefer skills from maintainers you trust, or copy the skill content into your own repo and install from there.","Report the repository to the registry maintainers if you confirm malicious content."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (typeof data.blockedSkillsCount === \"number\" && data.blockedSkillsCount > 0) {\n  // treat this repo as elevated-risk: audit remaining skills before install\n  console.warn(`${data.blockedSkillsCount} skills were hidden by the injection scanner.`);\n}","typeGuard":"function repoHasBlockedSkills(data: {\n  blockedSkillsCount?: number;\n}): boolean {\n  return (data.blockedSkillsCount ?? 0) > 0;\n}","tryCatchPattern":null,"preventionTips":["Treat blockedSkillsCount > 0 as a trust signal about the whole repository, not just the hidden skills.","Audit the source of every remaining skill from flagged repos before installing.","Prefer pinned, well-known repositories for skill installs."],"tags":["cli","skills","security","prompt-injection"],"backgroundTag":"prompt-injection-detected","analyzedSha":"5284672feb575908efead6fcf1b5e542f8d607bb","analyzedAt":"2026-08-18T18:00:18.510Z","schemaVersion":2},"datasetVersion":"2026-08-24T22:17:12.610Z"}