exa-search

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The setup instructions direct the user to use npx to download and run the exa-mcp-server package from the official npm registry. This is the standard installation path for the Exa search integration.
  • [COMMAND_EXECUTION]: The skill configures the agent to use npx to execute the MCP server. These commands are localized to the search tool's operation and are required for the skill's functionality.
  • [DATA_EXFILTRATION]: The skill transmits search queries and URLs to the Exa search engine at exa.ai. This is the primary intended purpose of the tool and is not a security concern.
  • [CREDENTIALS_UNSAFE]: The documentation correctly instructs users to provide their own API key via an environment variable (EXA_API_KEY) and uses a placeholder (YOUR_EXA_API_KEY_HERE) in the examples, adhering to security best practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 05:59 AM