Exa Research Papers

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:57 AM UTC
• Version: 1.0.0

Overview

The skill is a legitimate academic-paper search helper, but it asks agents to read unrelated local marketing context and run shell-style search commands with user-supplied topics.

Review this skill before installing. It appears intended for academic research, not abuse, but users should avoid using it with sensitive research topics or confidential workspace context unless they are comfortable sending derived queries to Exa. Agents should not blindly read local marketing context for ordinary literature searches, and any `exa.js` calls should pass user input as separate process arguments rather than interpolating it into a shell command.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:30
• Finding: Shell Command Injection Through Unescaped Research Query<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 30-45 **Vulnerability Type**: Shell command injection through unsafe interpolation of user-controlled input **Risk Level**: High ### Vulnerable Code ```bash exa.js search --query "[research topic]" --category "research paper" --num-results 10 ``` ```bash exa.js search --query "[topic]" --category "research paper" --num-results 10 --start-date [current-year]-01-01 # Use current year ``` ```bash exa.js search --query "[topic] [specific method or finding]" --category "research paper" --num-results 10 ``` ### Technical Analysis The skill instructs the agent to run shell commands through `exec` and substitute user-provided research topics into quoted command templates. Shell double quotes do not neutralize command substitutions such as `$(command)` or backtick expressions. They also permit some variable and escape processing. If the agent performs literal template substitution and passes the resulting string to a shell, a malicious research topic can cause the shell to evaluate attacker-controlled syntax before invoking `exa.js`. The same pattern occurs in the initial, date-filtered, and refined search commands. For example, a topic containing `$(id)` could result in local execution of `id` when embedded in the documented command. More harmful commands could read or modify any resources accessible to the agent process. ### Attack Path 1. An attacker supplies a research topic containing shell substitution syntax, such as `$(attacker_command)`. 2. The agent follows the skill and inserts the topic into the `--query` placeholder. 3. The agent invokes the generated command using a shell-backed `exec` facility. 4. The shell evaluates the injected substitution even though the query is enclosed in double quotes. 5. The attacker-controlled command executes with the operating-system permissions of the agent. 6. The ordinary Exa search may then continue, potentially concealing the injected execut ...[truncated 765 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct shell command strings by interpolating research topics. 2. Invoke `exa.js` through a process API that accepts an argument array and disables shell interpretation. For example, pass arguments equivalent to: - `exa.js` - `search` - `--query` - the complete user-provided topic as one argument - `--category` - `research paper` - `--num-results` - `10` 3. Explicitly document that the execution tool must use `shell: false` or an equivalent setting. 4. Treat topics, methods, findings, dates, and result IDs as untrusted data. 5. Validate structured values such as dates, result counts, and paper IDs against strict allowlists or formats. 6. If a shell is unavoidable, apply a proven platform-specific argument-escaping routine to every untrusted value. Do not rely on double quotes alone. 7. Add tests using payloads containing `$()`, backticks, quotes, semicolons, newlines, and redirection operators to verify that they remain literal arguments. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:16
• Finding: Unnecessary Access to Local Product-Marketing Context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 16-18 **Vulnerability Type**: Access beyond the minimum data scope required for academic-paper search **Risk Level**: Medium ### Vulnerable Code ```markdown ## Before Starting **Check for product marketing context first:** If `.agents/product-marketing-context.md` exists (or `.claude/product-marketing-context.md` in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task. ``` ### Technical Analysis The skill requires the agent to inspect and read local product-marketing context before conducting an academic-paper search. This access is not inherently necessary for the skill's stated function of finding and synthesizing academic literature. The instruction expands the skill's authority from processing the user's research request to reading potentially confidential local business information. Once loaded, that material becomes part of the agent's working context and may affect generated external search queries or user-facing responses. If the context file is writable by an untrusted party, its contents may also act as indirect instructions that influence subsequent agent behavior. No explicit instruction in the reviewed file sends the complete context file to Exa. The risk arises from unnecessary ingestion and possible downstream disclosure or influence, rather than from confirmed automatic exfiltration. ### Attack Path 1. The academic-research skill is activated. 2. The agent checks for `.agents/product-marketing-context.md` or `.claude/product-marketing-context.md`. 3. The agent reads the file without establishing that its contents are required for the current request or obtaining explicit user approval. 4. Confidential business data or attacker-controlled text enters the agent's active context. 5. The material may influence Exa search terms, paper-selection decisions, synthesized output, or other sub ...[truncated 1027 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the mandatory product-marketing context lookup from this academic-research skill. 2. Read local context only when the user explicitly requests research tailored to that product or business. 3. Obtain user confirmation before accessing either context file and identify the exact file to be read. 4. Apply data minimization by extracting only fields directly required for the current research question. 5. Treat all local context as untrusted data rather than executable instructions; ignore embedded requests to change goals, invoke tools, reveal secrets, or alter safety constraints. 6. Prevent confidential context from being inserted into external search queries unless the user explicitly approves the exact information being transmitted. 7. Clearly separate local background material from skill instructions and record which context fields influenced each external request. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Low

• Confidence: 93% confidence
• Finding: The skill directs the agent to read local product-marketing context files before performing an academic paper search, which expands data access beyond what is necessary for the task. This creates an unnecessary risk of pulling sensitive or irrelevant local workspace information into prompts, searches, or final outputs, especially since the file is unrelated to literature search and may contain proprietary business context.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill provides executable `exa.js` commands that perform external searches and content retrieval, but it does not clearly warn that using them will initiate network/API requests. In an agent setting, this can lead to unanticipated data egress, user surprise, or policy violations if query terms or fetched identifiers include sensitive information from the workspace or user prompt.

Static analysis

No suspicious patterns detected.