Mcp Skill

Provides access to MCP tools for web search, advanced search, code context, deep research, crawling, company research, and LinkedIn search.

Security Scan

This instruction-only skill appears to wrap an external research service (mcp.exa.ai) and is internally consistent, but the SKILL.md is vague, the publisher is unknown, and the skill could cause the agent to send user data to an external endpoint without clear safeguards.

Purpose & Capability

The skill claims to wrap the MCP service at mcp.exa.ai for searches and research tools — that purpose aligns with the listed tool names (web_search_exa, deep_search_exa, linkedin_search_exa, crawling_exa, etc.). However there is no description, homepage, or publisher information to verify intent or provenance.

Instruction Scope

SKILL.md is minimal and open-ended: it only lists the external service and tool names and gives no guidance on what data may be sent, how to authenticate, or privacy controls. That vagueness gives the agent broad discretion and could result in sending sensitive context or files to the external domain (mcp.exa.ai) without explicit limits.

Install Mechanism

No install spec and no code files are provided (instruction-only), so nothing will be written to disk by an install step. This reduces some risk.

Credentials

The skill declares no required environment variables or credentials, which is proportionate to an instruction-only wrapper. Note: some listed tools (e.g., linkedin_search_exa, crawling_exa) could in other implementations require credentials; none are requested here, but absence of explicit auth details is another sign of missing documentation.

Persistence & Privilege

always is false and the skill is user-invocable; it does not request persistent privileges or modify agent/system-wide settings.

What to consider before installing

Before installing, consider: (1) The skill will interact with an external domain (https://mcp.exa.ai) — ask the publisher what data is sent and how it is protected. (2) The SKILL.md is vague and there is no homepage or author info — request source code, API docs, or a privacy/security statement. (3) Avoid giving this skill access to sensitive contexts (secrets, private files, corporate data) until you verify behavior. (4) If you proceed, restrict its use, disable autonomous invocation where possible, and test in an isolated environment. If you cannot verify the publisher or data handling, do not install in sensitive environments.

This skill wraps the MCP at https://mcp.exa.ai/mcp for various tools such as web search, deep research, and more.

Tools Included

• web_search_exa
• web_search_advanced_exa
• get_code_context_exa
• deep_search_exa
• crawling_exa
• company_research_exa
• linkedin_search_exa
• deep_researcher_start
• deep_researcher_check