ClawHub
Back to skill

Security audit

Exa Tool

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Exa search integration with some credential-handling and privacy-disclosure issues users should account for before use.

Install only if you intend agents to send search terms, URLs, and research subjects to Exa. Prefer OpenClaw's scoped config or another secret manager for EXA_API_KEY, avoid workspace .env or system-wide credential storage, and limit tool access to agents that need external web research.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:52
Finding

Unsafe Plaintext API Key Persistence and Shell Sourcing

Content
View full analysis
~/.openclaw/workspace/.env source ~/.openclaw/workspace/.env ``` ``` The troubleshooting section also recommends broader credential storage: ```text - If using systemd/systemctl, set the key in the service file or `/etc/environment` ``` ### Technical Analysis The documented setup persists the Exa API key in predictable plaintext locations without establishing restrictive permissions. The redirection operator also unconditionally truncates the existing `.env` file and follows symbolic links. Consequently, following the instructions can destroy existing workspace configuration or overwrite another user-writable file targeted through a malicious symlink. Using `source` interprets the entire `.env` file as shell code rather than reading only the expected `EXA_API_KEY` value. If another process or local user can modify or replace this file before it is sourced, arbitrary commands in the file execute with the privileges of the user performing setup. The recommendation to place the key in `/etc/environment` or a service file can expose it more broadly than required. The Skill only needs access to one environment variable while executing, so system-wide credential persistence exceeds the minimum privilege and exposure necessary for its declared web-search function. ### Attack Path 1. A local attacker obtains write access to the OpenClaw workspace or can replace `~/.openclaw/workspace/.env`. 2. The attacker creates a malicious `.env` file containing the ...[truncated 1458 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Or create a .env file in your workspace:

bash
echo "EXA_API_KEY=your_exa_api_key_here" > ~/.openclaw/workspace/.env
source ~/.openclaw/workspace/.env

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Or create a .env file in your workspace:

bash
echo "EXA_API_KEY=your_exa_api_key_here" > ~/.openclaw/workspace/.env
source ~/.openclaw/workspace/.env

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README advertises crawling, people search, and company research features but does not warn that using them sends queries and possibly sensitive subjects to an external provider. In agent settings, this omission increases the risk of privacy violations, accidental collection of personal data, and compliance issues when users or agents research individuals or internal targets.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README states that agents can invoke the skill naturally for generic research requests and that the agent will automatically use the tool if allowed. This broad invocation framing can cause the skill to trigger on ordinary prompts without clear user awareness, leading to unintended external queries and data disclosure to a third-party service.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises environment-variable requirements and executable wrappers but does not declare an explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope boundaries can let the skill be invoked more broadly than intended and weakens policy enforcement around what external capabilities it uses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill clearly supports web search, crawling, company research, people search, and deep research via Exa, but it does not warn users that queries, URLs, and retrieved content may be sent to and processed by a third-party service. This creates a real data-handling and privacy risk because users may unknowingly submit sensitive prompts, internal URLs, or personal data to Exa.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The documentation recommends storing the API key persistently in ~/.openclaw/workspace/.env, which may place credentials inside a workspace path that other tools, sessions, or automation could read. Persisting secrets in a broadly accessible workspace increases exposure risk compared with using a dedicated secrets store or service-level environment configuration.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

export EXA_API_KEY="your_exa_api_key_here"

text

Or create a `.env` file in your workspace:
```bash
echo "EXA_API_KEY=your_exa_api_key_here" > ~/.openclaw/workspace/.env
source ~/.openclaw/workspace/.env

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This manifest file indicates the skill requires the EXA_API_KEY environment variable, which implies use of a sensitive credential and likely transmission to an external Exa service. The package metadata does not provide any accompanying warning or disclosure about that credential usage, privacy implications, or external network access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.