Security audit

Exa Research Papers

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate academic-paper search helper, but it asks agents to read unrelated local marketing context and run shell-style search commands with user-supplied topics.

Review this skill before installing. It appears intended for academic research, not abuse, but users should avoid using it with sensitive research topics or confidential workspace context unless they are comfortable sending derived queries to Exa. Agents should not blindly read local marketing context for ordinary literature searches, and any `exa.js` calls should pass user input as separate process arguments rather than interpolating it into a shell command.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:30
Finding: Shell Command Injection Through Unescaped Research Query
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:16
Finding: Unnecessary Access to Local Product-Marketing Context
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill directs the agent to read local product-marketing context files before performing an academic paper search, which expands data access beyond what is necessary for the task. This creates an unnecessary risk of pulling sensitive or irrelevant local workspace information into prompts, searches, or final outputs, especially since the file is unrelated to literature search and may contain proprietary business context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill provides executable exa.js commands that perform external searches and content retrieval, but it does not clearly warn that using them will initiate network/API requests. In an agent setting, this can lead to unanticipated data egress, user surprise, or policy violations if query terms or fetched identifiers include sensitive information from the workspace or user prompt.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.