The Agent Skills Directory

[SAFE]: No malicious patterns or security vulnerabilities were detected across the analyzed files.
[DATA_EXFILTRATION]: The skill interacts with the official Exa Search API (api.exa.ai), which is a well-known service. It contains explicit instructions (Guardrail 3) forbidding the redirection of search results to external network-transmitting commands like curl or wget to prevent accidental or malicious data leakage.
[CREDENTIALS_UNSAFE]: The skill follows security best practices by using environment variables for API keys. It includes specific instructions (Guardrails 1 and 2) prohibiting the agent from reading .env files or displaying key values in any form.
[COMMAND_EXECUTION]: The skill executes a local Node.js script (scripts/exa_search.mjs) to perform API requests. The script is transparent, uses standard libraries, and performs input validation on arguments like result count and date formats.
[PROMPT_INJECTION]: The skill implements specific safety instructions to prevent indirect prompt injection (Guardrail 4), instructing the agent never to construct search queries from untrusted sources like tool outputs or file contents.
[EXTERNAL_DOWNLOADS]: The skill does not perform any external downloads or remote code execution. All logic is contained within the local bundled script.

exa-search-hardened