Exa Web Search V2
AdvisoryAudited by VirusTotal on Mar 21, 2026.
Overview
Type: OpenClaw Skill Name: exa-web-search-v2 Version: 1.0.0 The skill bundle provides a legitimate interface for Exa AI's search services using the Model Context Protocol (MCP) via the 'mcporter' utility. All commands and URLs (e.g., https://mcp.exa.ai/mcp) are consistent with official Exa documentation, and there is no evidence of data exfiltration, malicious execution, or prompt injection in SKILL.md or references/examples.md.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Users may want to verify they are installing the intended Exa skill because the registry and packaged metadata do not fully align.
The packaged metadata differs from the supplied registry identity for the evaluated skill, which lists a different slug/version. This is a provenance and identity consistency note, not evidence of unsafe behavior.
"slug": "exa-web-search-free", "version": "1.0.1"
Confirm the skill name, slug, and source before installing, especially since the registry source and homepage are not declared.
Anything included in search queries, company names, URLs, or code-search prompts may be shared with the Exa MCP service.
The skill directs users to configure a remote MCP endpoint, so search queries and tool inputs are sent to an external provider. This is expected for the skill's search purpose.
mcporter config add exa https://mcp.exa.ai/mcp
Avoid sending secrets, private code, confidential business details, or personal data in queries unless you are comfortable sharing them with the provider.
If enabled, the agent has more ways to query or retrieve public web information through Exa, including profile searches and longer research tasks.
The optional configuration expands the available MCP tool surface to include crawling, people search, and a deep researcher. The artifact clearly labels this as optional and shows user-directed commands.
Enable all tools: mcporter config add exa-full "https://mcp.exa.ai/mcp?tools=web_search_exa,web_search_advanced_exa,get_code_context_exa,deep_search_exa,crawling_exa,company_research_exa,people_search_exa,deep_researcher_start,deep_researcher_check"
Enable the full tool set only when needed, review what query or URL is being sent, and keep sensitive information out of tool inputs.