The Agent Skills Directory

[SAFE]: The skill functions as a documentation guide for the Exa MCP server and does not contain any malicious code or instructions.
[EXTERNAL_DOWNLOADS]: The skill mentions downloading the exa-mcp-server package via npx. This is the official distribution method for a well-known service (Exa) and is considered safe under standard usage.
[CREDENTIALS_UNSAFE]: The skill correctly instructs users to handle sensitive API keys using environment variables (EXA_API_KEY) within the MCP configuration, avoiding hardcoded secrets.
[PROMPT_INJECTION]: The skill facilitates the retrieval of external web content, which is an inherent feature of search tools. While this introduces a surface for indirect prompt injection from external search results, there are no instructions within the skill that attempt to exploit this or bypass agent safety filters.

exa-search