exa-search
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill documentation describes network operations to api.exa.ai. These requests are consistent with the intended search functionality and target official vendor infrastructure associated with exa-labs.
- [CREDENTIALS_UNSAFE]: Authentication is managed via the $EXA_API_KEY environment variable. The skill correctly instructs the user on how to obtain and use their own keys, avoiding the use of hardcoded secrets.
- [COMMAND_EXECUTION]: Provides standard cURL command templates for interacting with the Exa API. These are basic HTTP request examples and do not involve suspicious command chaining, obfuscation, or piped remote script execution.
- [PROMPT_INJECTION]: The skill facilitates the ingestion of external search data from the web. While this represents a potential surface for indirect prompt injection, the skill is instructional in nature and does not contain instructions that would cause the agent to bypass safety constraints or execute untrusted code based on the search results.
Audit Metadata