{"record":{"id":"3e84a961b81f2bb1","repo":"upstash/context7","slug":"this-skill-contains-potentially-malicious-content","errorCode":null,"errorMessage":"This skill contains potentially malicious content and cannot be installed.","messagePattern":"This skill contains potentially malicious content and cannot be installed\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/cli/src/commands/skill.ts","lineNumber":262,"sourceCode":"    log.blank();\n    return;\n  }\n  const repo = `/${parsed.owner}/${parsed.repo}`;\n\n  log.blank();\n  const spinner = ora(`Fetching skills from ${repo}...`).start();\n\n  let selectedSkills: (Skill & { project: string })[];\n\n  // When a specific skill name is provided, fetch only that skill\n  if (skillName) {\n    spinner.text = `Fetching skill: ${skillName}...`;\n    const skillData = await getSkill(repo, skillName);\n\n    if (skillData.error || !skillData.name) {\n      if (skillData.error === \"prompt_injection_detected\") {\n        spinner.fail(pc.red(`Prompt injection detected in skill: ${skillName}`));\n        log.warn(\"This skill contains potentially malicious content and cannot be installed.\");\n        return;\n      }\n\n      spinner.text = `Fetching skill from GitHub: ${skillName}...`;\n      const ghResult = await getSkillFromGitHub(repo, skillName);\n      if (ghResult.status === \"repo_not_found\") {\n        spinner.fail(pc.red(`Repository not found: ${repo}`));\n        return;\n      }\n      if (ghResult.status !== \"ok\" || !ghResult.skill) {\n        spinner.fail(pc.red(`Skill not found: ${skillName}`));\n        return;\n      }\n\n      spinner.succeed(`Found skill: ${skillName}`);\n      selectedSkills = [ghResult.skill];\n    } else {\n      spinner.succeed(`Found skill: ${skillName}`);","sourceCodeStart":244,"sourceCodeEnd":280,"githubUrl":"https://github.com/upstash/context7/blob/5284672feb575908efead6fcf1b5e542f8d607bb/packages/cli/src/commands/skill.ts#L244-L280","documentation":"When installing a named skill (`context7 skill add <repo> <skill>`), getSkill(repo, skillName) hits the hosted registry, which runs prompt-injection detection over skill content. If the response carries `error: \"prompt_injection_detected\"`, the CLI fails the spinner and refuses to install, warning that the skill contains potentially malicious content. This is a deliberate security block, not a bug.","triggerScenarios":"Requesting a specific skill whose stored content matches injection patterns (instructions aimed at the AI agent, hidden directives, suspicious imperative text); the registry scans content server-side and returns the sentinel error string, which the CLI checks before falling back to a direct GitHub fetch.","commonSituations":"Installing a community skill that contains adversarial prompts targeting coding agents; occasionally a false positive on a skill whose legitimate content is phrased as agent instructions (which many skills are).","solutions":["Do not install the flagged skill — the block exists to protect the agent that will execute it.","Inspect the skill source yourself on GitHub to judge whether the flag is a false positive.","If it is clearly benign, report a false positive to the skill repository/registry maintainers.","Choose a different skill that provides the same capability without flagged content."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Check the sentinel error before attempting any install path\nconst skillData = await getSkill(repo, skillName);\nif (skillData.error === \"prompt_injection_detected\") {\n  // hard-stop: do not fall through to the GitHub mirror for flagged content\n  throw new Error(`Skill '${skillName}' flagged for prompt injection; refusing to install.`);\n}","typeGuard":"type SkillResponse =\n  | { error: \"prompt_injection_detected\" }\n  | { error?: string; name: string; /* ... */ };\n\nfunction isInjectionBlocked(r: SkillResponse): boolean {\n  return r.error === \"prompt_injection_detected\";\n}","tryCatchPattern":null,"preventionTips":["Never bypass the block by manually piping the flagged skill file into your agent config.","Review skill source on GitHub before installing anything from an unfamiliar repo.","Watch for blockedSkillsCount in list responses — it signals the repo already had flagged content.","Report confirmed false positives to registry maintainers instead of working around the check."],"tags":["cli","skills","security","prompt-injection","install"],"backgroundTag":"prompt-injection-detected","analyzedSha":"5284672feb575908efead6fcf1b5e542f8d607bb","analyzedAt":"2026-08-18T18:00:18.510Z","schemaVersion":2},"datasetVersion":"2026-08-24T22:17:12.610Z"}