Exa Cli

Security checks across static analysis, malware telemetry, and agentic risk

Overview

The skill is aligned with using Exa for web search, but users should notice that setup installs third-party CLI tooling and stores an Exa API token.

Before installing, verify the Exa CLI source and installer commands, be comfortable with the PATH change, and use a limited, revocable Exa API token. The documented behavior otherwise matches an Exa web-search CLI skill.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#ASI04: Agentic Supply Chain Vulnerabilities

Low

What this means

Installing the skill may run third-party setup code and modify the local CLI environment.

Why it was flagged

The setup depends on external, unpinned installer commands, including a remote shell installer. This is purpose-aligned for a CLI skill but should be verified before running.

Skill content

npx api2cli install Melvynx/exa-cli
...
bun --version || curl -fsSL https://bun.sh/install | bash

Recommendation

Review the referenced repositories/tools before running setup, prefer pinned or trusted install sources where possible, and avoid running curl-to-bash installers in sensitive environments.

#ASI03: Identity and Privilege Abuse

Low

What this means

The configured CLI may use the user's Exa account access and quota for searches, contents, answers, and context requests.

Why it was flagged

The skill asks the user to configure an Exa API token. This is expected for Exa API use, and the artifacts do not show token logging, hardcoding, or unrelated credential use.

Skill content

exa-cli auth set "your-token"
exa-cli auth test

Recommendation

Use a revocable Exa token with the minimum needed permissions, and rotate it if the local environment or installed CLI becomes untrusted.

#ASI05: Unexpected Code Execution

Low

What this means

The user's command environment may be changed so the installed CLI is found in future commands.

Why it was flagged

The setup/build/link flow can execute local tooling and persistently alter PATH. This is disclosed and aligned with making the CLI available, but it affects the user's shell environment.

Skill content

npx api2cli bundle exa
npx api2cli link exa

`api2cli link` adds `~/.local/bin` to PATH automatically.

Recommendation

Confirm PATH changes are acceptable before setup and remove the linked binary or PATH entry if the CLI is no longer wanted.