The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted content from the web via the Exa search engine, creating an attack surface for indirect prompt injection.
Ingestion points: The scripts/exa_search.py and scripts/exa_extract.py scripts fetch full-text content and highlights from arbitrary external URLs.
Boundary markers: While the reference files provide structured response formats (e.g., in references/web-search.md), there are no explicit delimiters or "ignore embedded instructions" warnings surrounding the external data being processed.
Capability inventory: The skill environment allows shell command execution (uv run) and file system writes (-o output.json).
Sanitization: There is no evidence of sanitization or filtering of the extracted web content before it is returned to the agent context.
[COMMAND_EXECUTION]: The instruction templates in references/web-search.md and references/web-extract.md direct the agent to interpolate user-provided input ($ARGUMENTS) and generated filenames ($FILENAME) directly into shell commands. This pattern poses a risk of command injection if the agent does not properly escape these variables before execution (e.g., if a query contains shell metacharacters like backticks or subshells).
[METADATA_POISONING]: There is a discrepancy in author identification; the SKILL.md metadata lists the author as "Exa", whereas external context identifies the author as "eturkes". This could potentially mislead users regarding the official status or support of the skill.
[EXTERNAL_DOWNLOADS]: The skill documentation suggests the installation of the python-dotenv[cli] package via pip or uv. While this is a common utility for environment variable management, it represents an external dependency outside of the core exa-py SDK.

exa-search