exa-upgrade-migration
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the
!commandsyntax in theCurrent Statesection ofSKILL.mdto executenpm listandnpm view. These commands are used solely to provide the user with the current and latest versions of theexa-jslibrary when the skill is accessed. - [EXTERNAL_DOWNLOADS]: The skill manages the
exa-jsdependency via the standard NPM registry. It also provides links to the official Exa GitHub repository and documentation for changelog verification. - [COMMAND_EXECUTION]: The instructions include standard development commands using
npmandgitfor creating upgrade branches, installing package updates, and executing local test suites. - [DATA_EXPOSURE_AND_EXFILTRATION]: The verification script utilizes
process.env.EXA_API_KEYto authenticate requests to the Exa API. This follows standard security practices for secret management and does not involve unauthorized exfiltration or hardcoded credentials.
Audit Metadata