The Agent Skills Directory

[COMMAND_EXECUTION]: The shell scripts utilize curl and jq to interact with the Exa AI API. All user-supplied inputs are safely interpolated into JSON payloads using jq's argument handling, which prevents shell injection vulnerabilities.
[DATA_EXFILTRATION]: Outbound network activity is limited to the official api.exa.ai endpoint. The skill does not access local sensitive files, system configurations, or private credentials; it only transmits the search queries and URLs provided as tool arguments.
[PROMPT_INJECTION]: Because the skill retrieves text and summaries from external websites, it possesses an inherent attack surface for indirect prompt injection. Malicious instructions embedded in searched web pages could potentially be processed by the agent. This risk is common to all web-retrieval tools and is managed by the agent's internal safety guardrails.

exa