ClawHub
Back to skill

Security audit

D.Va Exa Web Search Free

Security checks for vulnerabilities and agentic risk

Overview

This skill is a transparent Exa search setup; its main risk is that search queries go to an external provider and optional advanced tools broaden research capability.

Install this only if you are comfortable sending search, code, company, and optional profile-research queries to Exa. Use the basic Exa configuration for normal search, and enable the full toolset only when you specifically need crawling, people search, or deep-research capabilities.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
- `people_search_exa` - Professional profiles
- `deep_researcher_start/check` - AI research agent

**Enable all tools:**
```bash
mcporter config add exa-full "https://mcp.exa.ai/mcp?tools=web_search_exa,web_search_advanced_exa,get_code_context_exa,deep_search_exa,crawling_exa,company_research_exa,people_search_exa,deep_researcher_start,deep_researcher_check"
Confidence
83% confidence
Finding
The 'Enable all tools' guidance normalizes unrestricted access to all listed Exa capabilities instead of encouraging selective enablement. In this skill context, that is more dangerous because the skill is a search/research integration and some optional tools can retrieve richer external content or profile data than is necessary for basic web/code/company search, expanding both privacy and misuse risks.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
- `people_search_exa` - Professional profiles
- `deep_researcher_start/check` - AI research agent

**Enable all tools:**
```bash
mcporter config add exa-full "https://mcp.exa.ai/mcp?tools=web_search_exa,web_search_advanced_exa,get_code_context_exa,deep_search_exa,crawling_exa,company_research_exa,people_search_exa,deep_researcher_start,deep_researcher_check"
Confidence
83% confidence
Finding
The 'Enable all tools' guidance normalizes unrestricted access to all listed Exa capabilities instead of encouraging selective enablement. In this skill context, that is more dangerous because the skill is a search/research integration and some optional tools can retrieve richer external content or profile data than is necessary for basic web/code/company search, expanding both privacy and misuse risks.

Static analysis

No suspicious patterns detected.