exa-search

SUSPICIOUS: the skill’s stated purpose is coherent with Exa-backed semantic search, and its data flow appears intended for the official Exa service, but the installation model is a transitive trust chain through `npx skills add` to a personal GitHub repo with no pinning or release verification. This is not confirmed malware, but it carries medium supply-chain risk disproportionate to a simple instruction skill.