cli-anything-exa

SUSPICIOUS: the core capability matches a search skill and the Exa API key requirement is proportionate, but the install path is inconsistent and relies on an unpinned GitHub VCS package rather than a clearly verified release. The skill also exposes the agent to untrusted web content, which is a meaningful prompt-injection risk for agent workflows.