Security audit
OpenClaw Exa Plugin
Security checks for vulnerabilities and agentic risk
Overview
The plugin provides Exa web searches using your API key, with no hidden or unrelated behavior found.
Search queries leave your device and use your Exa account. Keep the default endpoint or choose a trusted HTTPS endpoint, since a custom endpoint receives your API key too. Package runtime code was independently reviewed; host SDK internals were outside this review.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.
Endor dependency reachability
Checked Nov 3, 2026 · 4:42 AM UTC
No reachable vulnerabilities reported
Endor dependency scan completed.