First Seen
Feb 18, 2026
Last Scanned
Feb 20, 2026
Findings
2
Score
92/100
Findings (2)
Detects fetching remote documentation or code to load as agent context
WebFetch to retrieve + https://context7.com/{org}/{repo}/llms.txtPin the SDK or script to a specific version and verify its checksum after download. Prefer installing SDKs via a package manager instead of fetching remote scripts directly.
Likely FP if the match is documentation showing how to install an official SDK (e.g., Google Cloud SDK, AWS CLI) from its canonical URL.
Detects global installation of packages which affects the host system
npm install -g rReplace npm install -g with a local install (npm install --save-dev) or use npx with a pinned version. Global installs modify the system and risk supply chain attacks.
Likely FP if the global install is for a well-known CLI tool (e.g., typescript, eslint) in setup documentation, though the supply chain risk remains real.