Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Exa Company Research

v1.0.0

When the user wants to research a company using web search -- company overview, products, funding, team, and recent news. Also use when the user mentions 'co...

0· 223·0 current·0 all-time
byMario Karras@mariokarras

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for mariokarras/abm-exa-company-research.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Exa Company Research" (mariokarras/abm-exa-company-research) from ClawHub.
Skill page: https://clawhub.ai/mariokarras/abm-exa-company-research
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install abm-exa-company-research

ClawHub CLI

Package manager switcher

npx clawhub@latest install abm-exa-company-research
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md describes web-based company research via an 'Exa' CLI and reading an optional product-marketing-context file. That aligns with the stated purpose, but the skill assumes the presence of a local Node-based CLI (node tools/clis/exa.js) and an Exa service/backend without declaring those runtime requirements.
Instruction Scope
Instructions stay within the research task (search, fetch contents, synthesize). They explicitly tell the agent to read .agents/product-marketing-context.md (or .claude/...) if present — reasonable for context reuse but worth reviewing because those workspace files can contain sensitive internal details.
Install Mechanism
No install spec and no code files are present (instruction-only). That minimizes installer risk.
!
Credentials
The skill requests no env vars or credentials, yet it depends on an Exa CLI that almost certainly requires authentication and also invokes 'node'. The lack of declared runtime dependencies or credential requirements is an omission that reduces transparency and could hide prerequisites (API keys, tokens, or preconfigured client credentials) in the environment.
Persistence & Privilege
always is false and there is no install or code that persists beyond the agent's runtime. The skill does instruct reading workspace context files but does not request elevated or persistent privileges.
What to consider before installing
Before installing, confirm these points with the skill author or your ops team: - Ensure the runtime environment actually contains 'node' and the expected local CLI script at tools/clis/exa.js (or provide a declared dependency). If the CLI is missing the skill cannot run. - Ask how the Exa CLI authenticates: does it require an API key, config file, or environment variables? The skill does not declare any required credentials — verify where those secrets would be stored and whether they are appropriate to share with the agent. - Review any .agents/product-marketing-context.md or .claude/product-marketing-context.md files the skill would read for sensitive information before allowing the skill to access them. - If you do not want the agent running arbitrary local commands, do not enable autonomous invocation for untrusted skills and verify the toolchain in a sandbox first. If the author can supply a short runtime requirements list (node version, exa CLI location, and required auth variables) and confirm no hidden credential exfiltration, this skill would be coherent for its purpose.

Like a lobster shell, security has layers — review code before you run it.

latestvk977sxh06kh3crc1c7t4h8dvgh8359x0
223downloads
0stars
1versions
Updated 23h ago
v1.0.0
MIT-0

Exa Company Research

You help users research companies by searching the web via Exa. Your goal is to gather comprehensive company intelligence -- what the company does, who leads it, how it's funded, and what's happening recently.

Before Starting

Check for product marketing context first: If .agents/product-marketing-context.md exists (or .claude/product-marketing-context.md in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.

Understand what the user needs (ask if not provided):

  1. Company name or domain -- the target company
  2. Research focus -- overview, funding, team, product, news, or all
  3. Purpose -- competitive research, partnership evaluation, prospect qualification, etc.

Workflow

Step 1: Search for Company Information

Run a broad search for the company:

node tools/clis/exa.js search --query "[company name] company overview" --num-results 10 --text

Review the results. If the company has a common name, add the domain or industry to narrow results:

node tools/clis/exa.js search --query "[company name] [domain.com] overview" --num-results 10 --text

To preview the request without making an API call:

node tools/clis/exa.js search --query "[company name] company overview" --num-results 10 --dry-run

Step 2: Narrow by Focus Area

Based on the user's research focus, run targeted searches:

  • Funding: node tools/clis/exa.js search --query "[company] funding round investment" --num-results 5 --text
  • Team: node tools/clis/exa.js search --query "[company] leadership team executives" --num-results 5 --text
  • Product: node tools/clis/exa.js search --query "[company] product features pricing" --num-results 5 --text
  • News: node tools/clis/exa.js search --query "[company] news announcement" --num-results 5 --start-date "[30 days ago YYYY-MM-DD]" --text

Skip this step if the user wants a general overview -- the initial search usually covers enough.

Step 3: Fetch Detailed Content

For the most relevant results from Steps 1-2, fetch full content using the result IDs:

node tools/clis/exa.js contents --ids "[id1],[id2],[id3]" --text --highlights

Focus on 3-5 of the most relevant sources. Quality over quantity.

Step 4: Synthesize Findings

Organize everything into the output format below. Cross-reference multiple sources for accuracy. Flag anything that appears outdated or unverified.

Output Format

Structure your findings as:

Company Overview

  • Name: [Full legal/brand name]
  • Website: [Primary domain]
  • One-liner: [What they do in one sentence]
  • Founded: [Year]
  • Headquarters: [City, Country]
  • Company size: [Employee count or range, if available]

Products & Services

  • [Product/service 1]: [Brief description]
  • [Product/service 2]: [Brief description]

Team & Leadership

NameTitleBackground
[Name][Title][Notable background]

Funding & Financials

  • Total raised: [Amount, if available]
  • Latest round: [Type, amount, date]
  • Key investors: [Notable investors]
  • Revenue signals: [Any public revenue data or signals]

Recent News

  • [Date]: [Headline / summary]
  • [Date]: [Headline / summary]

Competitive Position

  • Market: [Industry/category]
  • Key competitors: [Top 2-3 competitors]
  • Differentiation: [What sets them apart]

Related Skills

  • exa-people-search: Find specific individuals at companies
  • exa-lead-generation: Build prospect lists matching criteria
  • competitor-alternatives: Create competitor comparison and alternative pages

Comments

Loading comments...