The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and installs the exa-py package from PyPI. This is a standard dependency for the skill's core functionality and is managed via the official Python package registry.
[COMMAND_EXECUTION]: The skill executes Python scripts (exa_search.py, exa_extract.py) using uv run. These scripts are part of the skill's own codebase and are used to interface with the Exa API. The commands take user-supplied arguments for search queries and URLs, which is the intended purpose of the tool.
[DATA_EXPOSURE]: The skill requires an EXA_API_KEY. It correctly instructs the user to provide this via environment variables or a .env file, adhering to standard security practices for API key management. It does not attempt to access unrelated sensitive files or credentials.
[INDIRECT_PROMPT_INJECTION]: The skill processes external web content and academic papers. It includes instructions for the agent to 'keep content verbatim' and 'never summarize a paper you have not retrieved,' which helps mitigate risks associated with processing untrusted external data, although the inherent attack surface is present when reading web pages.
[SAFE]: The network requests are made to exa.ai via the official SDK, which is the service provider for the skill. The metadata and implementation are consistent with the stated goal of technical research assistance.

exa-search