upstash/context7 · error

This skill contains potentially malicious content and cannot

Error message

This skill contains potentially malicious content and cannot be installed.

What it means

When installing a named skill (`context7 skill add <repo> <skill>`), getSkill(repo, skillName) hits the hosted registry, which runs prompt-injection detection over skill content. If the response carries `error: "prompt_injection_detected"`, the CLI fails the spinner and refuses to install, warning that the skill contains potentially malicious content. This is a deliberate security block, not a bug.

Source

Thrown at packages/cli/src/commands/skill.ts:262

    log.blank();
    return;
  }
  const repo = `/${parsed.owner}/${parsed.repo}`;

  log.blank();
  const spinner = ora(`Fetching skills from ${repo}...`).start();

  let selectedSkills: (Skill & { project: string })[];

  // When a specific skill name is provided, fetch only that skill
  if (skillName) {
    spinner.text = `Fetching skill: ${skillName}...`;
    const skillData = await getSkill(repo, skillName);

    if (skillData.error || !skillData.name) {
      if (skillData.error === "prompt_injection_detected") {
        spinner.fail(pc.red(`Prompt injection detected in skill: ${skillName}`));
        log.warn("This skill contains potentially malicious content and cannot be installed.");
        return;
      }

      spinner.text = `Fetching skill from GitHub: ${skillName}...`;
      const ghResult = await getSkillFromGitHub(repo, skillName);
      if (ghResult.status === "repo_not_found") {
        spinner.fail(pc.red(`Repository not found: ${repo}`));
        return;
      }
      if (ghResult.status !== "ok" || !ghResult.skill) {
        spinner.fail(pc.red(`Skill not found: ${skillName}`));
        return;
      }

      spinner.succeed(`Found skill: ${skillName}`);
      selectedSkills = [ghResult.skill];
    } else {
      spinner.succeed(`Found skill: ${skillName}`);

View on GitHub (pinned to 5284672feb)

Solutions

1. Do not install the flagged skill — the block exists to protect the agent that will execute it.
2. Inspect the skill source yourself on GitHub to judge whether the flag is a false positive.
3. If it is clearly benign, report a false positive to the skill repository/registry maintainers.
4. Choose a different skill that provides the same capability without flagged content.

// Check the sentinel error before attempting any install path
const skillData = await getSkill(repo, skillName);
if (skillData.error === "prompt_injection_detected") {
  // hard-stop: do not fall through to the GitHub mirror for flagged content
  throw new Error(`Skill '${skillName}' flagged for prompt injection; refusing to install.`);
}

type SkillResponse =
  | { error: "prompt_injection_detected" }
  | { error?: string; name: string; /* ... */ };

function isInjectionBlocked(r: SkillResponse): boolean {
  return r.error === "prompt_injection_detected";
}

When it happens

Trigger: Requesting a specific skill whose stored content matches injection patterns (instructions aimed at the AI agent, hidden directives, suspicious imperative text); the registry scans content server-side and returns the sentinel error string, which the CLI checks before falling back to a direct GitHub fetch.

Common situations: Installing a community skill that contains adversarial prompts targeting coding agents; occasionally a false positive on a skill whose legitimate content is phrased as agent instructions (which many skills are).

Related errors

• Review other skills from this repository carefully before in
• No skills found in ${repo}
• Fix permissions with:
• Failed to install ${skill.name}: ${errMsg}
• Installation cancelled

AI-assisted analysis of upstash/context7@5284672feb (2026-08-18). Data as JSON: /api/errors/3e84a961b81f2bb1. Report an issue: GitHub.