The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses localized shell scripts (search.sh, code.sh, content.sh) to interface with the Exa AI API. These scripts are implemented using safe practices, specifically employing jq to construct JSON payloads, which prevents command injection or argument smuggling that can occur when manually building strings for curl commands.
[DATA_EXFILTRATION]: The skill documents strict guardrails against data exfiltration, instructing the agent to never pipe search results to network-transmitting commands like curl or nc. The provided scripts only communicate with the official Exa AI endpoint (api.exa.ai).
[REMOTE_CODE_EXECUTION]: The skill does not download or execute any remote scripts. It uses a well-known third-party service (Exa AI) for search functionality via standard HTTPS API calls.
[EXTERNAL_DOWNLOADS]: Fetches search results and web content from Exa AI's official API. The content extraction script (content.sh) is paired with an SSRF prevention guardrail in SKILL.md to prevent it from being used against internal network addresses or cloud metadata endpoints.

exa-hardened