Exa

AI-powered web and code search, content extraction, URL crawling, and asynchronous research with customizable schema and filters using EXA_API_KEY.

Security Scan

The skill's code, requirements, and instructions are internally consistent with a web/code search and async research client that uses an EXA_API_KEY to call api.exa.ai; nothing in the package indicates unrelated or hidden exfiltration.

Purpose & Capability

Name/description match the files and behavior: scripts implement web/search/content extraction/research flows and call https://api.exa.ai endpoints. Requested binaries (curl, jq) and required env var (EXA_API_KEY) are exactly what is needed for this purpose.

Instruction Scope

Runtime instructions and scripts stay within the stated scope (they only read EXA_API_KEY from the environment or .env and call api.exa.ai). The scripts will upload SCHEMA_FILE contents to the research endpoint if provided; the repository includes explicit warnings and a filename-pattern guard that blocks many obvious sensitive paths but does not (and cannot) guarantee safety for arbitrary local files. Users should avoid pointing SCHEMA_FILE at any confidential local data.

Install Mechanism

No install spec; the skill is instruction + shell scripts only. No remote downloads or extracted archives. Low installation risk.

Credentials

Only EXA_API_KEY is required which is proportional to a hosted API client. The only potentially sensitive transmission is SCHEMA_FILE content (intended behavior) — the code explicitly warns about this and implements filename-based guards and a size limit, but uploading arbitrary local files remains a user-controlled risk.

Persistence & Privilege

always:false and no code to modify agent/system configuration or other skills. The skill does not request persistent system privileges or write to other skills' configs.

Assessment

This package appears to be a straightforward client for Exa's APIs. Before installing: (1) Only provide an EXA_API_KEY you trust — the scripts send it as x-api-key to api.exa.ai. (2) Do not point SCHEMA_FILE at sensitive local files; the tool will upload the schema JSON to Exa (there is a filename guard for obvious secrets, but it is not foolproof). (3) The scripts use curl/jq to make network requests to api.exa.ai/docs.exa.ai/exa.ai; if you do not want network access, do not install. (4) If you need stricter protection, use a scoped or ephemeral API key and inspect calls in an isolated environment first.

Exa - Search + Research

Use this skill for web search, code-context search, URL content extraction, and async research workflows.

What This Skill Does

• Run Exa web search with optional category and domain filters.
• Retrieve full page content (and optional subpage crawling).
• Find code and docs context for programming queries.
• Run async research tasks (one-shot or create/poll workflows).
• Support optional structured outputs via outputSchema.

Setup

Set EXA_API_KEY using one of these methods.

export EXA_API_KEY="your-exa-api-key"

# .env next to SKILL.md
EXA_API_KEY=your-exa-api-key

Behavior:

• If EXA_API_KEY is missing in the environment, scripts load only EXA_API_KEY from .env.
• Other .env variables are ignored by the loader.

Safety and Data Handling

• SCHEMA_FILE content is sent to https://api.exa.ai/research/v1 as outputSchema.
• Never use sensitive local files for SCHEMA_FILE (for example: .env, key/cert files, secrets, internal confidential docs).
• research_create.sh blocks obvious sensitive paths/suffixes (for example: .env, .pem, .key, .p12, .pfx, id_rsa).

Command Quick Reference

Search

bash scripts/search.sh "query"

Main env vars:

• NUM=10 (max 100)
• TYPE=auto (auto, neural, fast, deep, instant)
• CATEGORY= (company, research paper, news, tweet, personal site, financial report, people)
• DOMAINS=domain1.com,domain2.com
• EXCLUDE=domain1.com,domain2.com
• SINCE=YYYY-MM-DD
• UNTIL=YYYY-MM-DD
• LOCATION=NL

Constraints:

• EXCLUDE is not supported when CATEGORY=company or CATEGORY=people.
• SINCE and UNTIL are not supported when CATEGORY=company or CATEGORY=people.
• When CATEGORY=people, DOMAINS accepts LinkedIn domains only (linkedin.com, www.linkedin.com, *.linkedin.com).

Content Extraction

bash scripts/content.sh "url1" "url2"

Main env vars:

• MAX_CHARACTERS=2000
• HIGHLIGHT_SENTENCES=3
• HIGHLIGHTS_PER_URL=2
• SUBPAGES=10
• SUBPAGE_TARGET="docs,reference,api"
• LIVECRAWL=preferred (preferred, always, fallback)
• LIVECRAWL_TIMEOUT=12000

Code Context Search

bash scripts/code.sh "query" [num_results]

Research (One-shot)

bash scripts/research.sh "instructions"

Main env vars:

• MODEL=exa-research or MODEL=exa-research-pro
• SCHEMA_FILE=path/to/schema.json
• POLL_INTERVAL=2
• MAX_WAIT_SECONDS=240
• EVENTS=true

Research (Create/Poll)

bash scripts/research_create.sh "instructions" | jq
bash scripts/research_poll.sh "researchId" | jq

Agent Decision Rules

Choose TYPE for Search

Use this decision order:

1. User explicitly asks for realtime or autocomplete -> TYPE=instant.
2. Task needs broad coverage or deeper synthesis -> TYPE=deep.
3. User asks for speed/quality balance -> TYPE=fast.
4. Otherwise -> TYPE=auto (default).

Fallback/escalation:

• If too slow or time-sensitive: deep -> auto -> fast -> instant.
• If too shallow: instant -> fast -> auto -> deep.
• Explicit user requirement always wins.

Recommended pattern:

TYPE=auto bash scripts/search.sh "query"

Common Pitfalls

• Do not pass sensitive files to SCHEMA_FILE.
• Do not combine CATEGORY=people|company with EXCLUDE, SINCE, or UNTIL.
• Prefer https://docs.exa.ai/ for subpage crawling seeds (more reliable than https://exa.ai/docs/reference/).

More Examples

See EXAMPLES.md for grouped command examples and edge-case workflows.