Exa

• Analyzed: May 13, 2026, 3:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: b23a42bc74fde6ef74543325e8eaec22efae7dbb9aeea08971490890aa1e7ead
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is a legitimate wrapper for the Exa AI API. All scripts (`code.sh`, `content.sh`, `search.sh`) interact with the official `https://api.exa.ai/` endpoint, using `curl` and `jq` to construct and send JSON payloads. API keys are securely loaded from `~/.clawdbot/credentials/exa/config.json` (as instructed in `SKILL.md`) or expected in environment variables. There is no evidence of data exfiltration, malicious execution, persistence, obfuscation, or prompt injection attempts against the agent beyond the stated purpose of performing web searches and content extraction.