Exa
v1.0.0Neural web search via Exa AI. Search people, companies, news, research, code. Supports deep search, domain filters, date ranges.
⭐ 2· 3.6k·13 current·13 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Skill name/description (neural web search) match the included scripts which POST queries and URLs to https://api.exa.ai. However the registry metadata listed no required binaries or credentials while SKILL.md and scripts clearly require curl, jq, and an EXA API key (config file or EXA_API_KEY). This mismatch is an incoherence (likely sloppy packaging) but the requested items themselves are consistent with the stated purpose.
Instruction Scope
SKILL.md and the scripts limit actions to building JSON payloads and calling Exa's API endpoints. The scripts only read the declared credentials file (~/.clawdbot/credentials/exa/config.json) or EXA_API_KEY and do not attempt to read other system files or secret stores. They do send user-provided URLs and queries to an external service (expected for search/content extraction).
Install Mechanism
There is no install spec (instruction-only with bundled scripts), so nothing is downloaded or written automatically beyond the included script files. Risk from install mechanism is low, but running the scripts will contact external endpoints.
Credentials
The skill requires an API key for Exa (EXA_API_KEY or config file) which is proportionate to performing API calls. The incoherence is that the registry metadata did not declare required env vars/binaries while SKILL.md and scripts do—this discrepancy should be resolved before trust. No unrelated credentials or wide secret access are requested.
Persistence & Privilege
The skill does not request always:true and does not attempt to modify other skills or system settings. It only reads its own config file in the user's home directory.
What to consider before installing
This skill appears to be a simple client that sends search queries and URLs to api.exa.ai and needs curl, jq, and an Exa API key stored at ~/.clawdbot/credentials/exa/config.json or EXA_API_KEY. Before installing: (1) verify the publisher/source and confirm api.exa.ai is the legitimate API endpoint for the vendor you expect (no homepage is provided), (2) confirm you trust sending your queries and any URLs (including potentially sensitive pages) to that external service, (3) ensure curl and jq are available, and (4) prefer creating and protecting a dedicated API key with limited scope. The main red flag is the registry metadata mismatch (it doesn’t list required bins or credentials) — this can be innocent packaging error but also indicates the publisher may be sloppy; if you need higher assurance, request the skill's provenance or an official homepage before use.Like a lobster shell, security has layers — review code before you run it.
latestvk974e4dtv7bdz1fxz2mehn15qd7yv0mj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🧠 Clawdis
Binscurl, jq