Exa Personal Site Search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:57 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent search purpose, but its command templates can turn a crafted person name or affiliation into shell command execution.

Review before installing. Use only if your agent will pass search terms as structured arguments to the Exa CLI or safely escape/reject shell metacharacters in names, companies, universities, roles, handles, and locations. Be aware it may read local product-marketing context files when present.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:26

Finding

Shell Command Injection Through User-Controlled Search Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26–37
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

bash

exa.js search --query "[person name] personal site" --category "personal site" --num-results 10

bash

exa.js search --query "[person name] [company/university/role]" --category "personal site" --num-results 10

Technical Analysis

The skill directs the agent to execute shell command strings containing a person's name and affiliations supplied by the user. It does not require validation, shell escaping, or invocation through a structured argument array with shell interpretation disabled.

Wrapping input in double quotes is insufficient protection. An attacker can include a double quote to terminate the intended argument and then append shell operators or commands. Shell substitutions such as $(...) may also execute inside double-quoted strings.

For example, if the person name is supplied as:

text

" ; malicious_command ; #

direct substitution produces a command equivalent to:

bash

exa.js search --query "" ; malicious_command ; # personal site" --category "personal site" --num-results 10

The shell can execute malicious_command independently of exa.js.

Attack Path

1. An attacker asks the agent to search for a person whose purported name or affiliation contains a crafted shell payload.
2. The agent inserts that value into one of the documented command templates.
3. The agent runs the resulting string through exec, as explicitly directed by the skill.
4. The shell terminates the intended quoted argument and interprets the injected operators or substitutions.
5. The injected command executes with the operating-system permissions and environment available to the agent process.

Impact Assessment

Successful exploitation permits arbitrary command execution under the agent's local account. Dependin ...[truncated 397 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct shell command strings by interpolating user-controlled values.
• Invoke exa.js through a process API that accepts a structured argument array and disables shell processing. For example, pass the query as one argument rather than embedding it in a command string.
• Treat the person's name, company, university, role, location, and handle as untrusted input.
• If a shell cannot be avoided, apply robust platform-appropriate escaping to every untrusted value and reject control characters, quotes, command substitutions, redirection operators, and command separators.
• Add explicit instructions that user input must never be interpreted as shell syntax.
• Run the search tool with least privilege, a minimal environment, restricted filesystem access, and no unnecessary credentials.
• Add security tests covering payloads with ", ', ;, &, |, backticks, $(), newlines, and redirection operators.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.