Exa Search

Use Exa (exa.ai) Search API to search the web and return structured results (title/url/snippet/text) via a local Node script. Trigger when the user asks to enable Exa search, configure Exa API key, or perform web search using Exa.

Security Scan

The skill's code, instructions, and requested credential (EXA_API_KEY) align with its stated purpose of calling Exa's Search API via a local Node script; nothing in the bundle suggests unrelated access or hidden exfiltration.

Purpose & Capability

Name/description match the implementation: the script issues a POST to https://api.exa.ai/search and requires node + EXA_API_KEY. The required binary and primary credential are appropriate and proportional for a search integration.

Instruction Scope

SKILL.md instructs running the bundled Node script and only references the EXA_API_KEY. The doc suggests storing the key in the Gateway environment or ~/.openclaw/.env; the script itself only reads process.env.EXA_API_KEY and does not read files. Minor inconsistency: registry lists no required config paths but the README recommends ~/.openclaw/.env as a storage location.

Install Mechanism

No install spec or remote downloads are present — the skill is instruction + a local script. No third-party packages are being pulled at install time, so disk-write/remote-code risks are low.

Credentials

Only EXA_API_KEY is requested and declared as primaryEnv. No unrelated secrets or multiple credentials are required. The script uses the key solely to call the Exa API.

Persistence & Privilege

always:false and no behavior that modifies other skills or system-wide config. The skill does not request persistent elevated privileges.

Assessment

This skill appears coherent and limited to calling Exa's search endpoint. Before installing: (1) confirm you trust exa.ai and the endpoint URL; (2) limit the EXA_API_KEY permissions and rotate it if possible; (3) prefer setting the key in the Gateway environment rather than dropping it in a plain file like ~/.openclaw/.env; (4) be aware the script can return full page text if you enable --text (that may reveal sensitive content); and (5) because the bundle contains a runnable script, review it yourself (it only calls the Exa API and prints JSON). If you need stronger assurance, ask the publisher for a homepage/source or a signed release.

Use Exa’s Search API via the bundled script.

Requirements

• Set EXA_API_KEY in the Gateway environment (recommended) or in ~/.openclaw/.env.

Commands

• Run a search:

  • node {baseDir}/scripts/exa_search.mjs "<query>" --count 5

• Include page text in results (costs more):

  • node {baseDir}/scripts/exa_search.mjs "<query>" --count 5 --text

• Narrow by time window:

  • --start 2025-01-01 --end 2026-02-04

Notes

• This skill does not modify web_search; it provides an Exa-backed alternative you can invoke when you specifically want Exa.