Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Exa Research Papers

v1.0.0

Find academic papers, studies, and research on any topic using Exa's research paper category search. Use when the user mentions 'find papers,' 'research pape...

0· 218·1 current·1 all-time
byMario Karras@mariokarras

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for mariokarras/abm-exa-research-papers.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Exa Research Papers" (mariokarras/abm-exa-research-papers) from ClawHub.
Skill page: https://clawhub.ai/mariokarras/abm-exa-research-papers
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install abm-exa-research-papers

ClawHub CLI

Package manager switcher

npx clawhub@latest install abm-exa-research-papers
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md explicitly instructs the agent to run the exa.js CLI (exa.js search / exa.js contents), which is central to the skill's functionality; however, the skill metadata declares no required binaries and provides no install specification. That inconsistency means the skill either assumes a binary will already exist (unstated requirement) or is missing an install step. Additionally, the instructions reference reading .agents/product-marketing-context.md (or .claude/...), which is outside the stated 'find papers' purpose unless marketing context is deliberately needed — this file access is not declared in required config paths.
!
Instruction Scope
Runtime instructions direct exec of a local binary (exa.js) and instruct the agent to read product-marketing-context files if present. exec-style commands can run arbitrary code; the SKILL.md gives no guardrails, no verification of the binary's origin, and no explicit limit on what local files can be read. The instruction also permits fetching paper contents (which may require API credentials in practice) but those credentials are not declared.
!
Install Mechanism
There is no install spec (instruction-only), which is low risk if the agent only runs safe, declared commands. Here, however, the skill depends on an external CLI (exa.js) yet provides no install instructions or trusted source for that binary. That omission raises risk: users may run an unknown exa.js obtained from an untrusted source, or the agent may fail or call an unexpected binary on PATH.
!
Credentials
The skill declares no required environment variables or credentials, but the described workflow (searching and fetching paper contents via exa.js) commonly requires API keys or service credentials. The SKILL.md also asks the agent to read product-marketing-context files from the workspace, which might contain sensitive information. The lack of declared environment/credential requirements is disproportionate to the operations the skill performs.
Persistence & Privilege
The skill does not request permanent presence (always: false) and does not declare actions that modify other skills or system-wide settings. It appears to be user-invocable and not forcibly injected into all agent runs.
What to consider before installing
Do not enable this skill without clarifying a few things. Ask the publisher: (1) Where does exa.js come from? Provide an install spec or canonical source (GitHub release, npm package with homepage, or packaged binary). (2) Does exa.js require API keys or other credentials? If so, the skill should declare them in requires.env and explain scope/usage. (3) Why does the skill read .agents/product-marketing-context.md and what sensitive data might that file contain? If you permit file reading, limit the skill's workspace access or sanitize the file first. If you must test, run the agent in a restricted sandbox and verify the exa.js binary's source and contents before allowing exec. If the publisher cannot answer these questions or provide an install/credential spec, treat the skill as untrusted.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dres548cjfwmnfew9qffy9x836t3c
218downloads
0stars
1versions
Updated 4m ago
v1.0.0
MIT-0

Exa Research Papers

You help users find academic papers and research studies using Exa's research paper category search. Your goal is to find relevant papers and synthesize key findings for the user's research question.

Before Starting

Check for product marketing context first: If .agents/product-marketing-context.md exists (or .claude/product-marketing-context.md in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.

Understand what the user needs (ask if not provided):

  1. Research topic -- what subject or question are they researching?
  2. Specific questions -- what do they want to learn or prove?
  3. Field/discipline -- if known (e.g., computer science, psychology, economics)
  4. Recency preference -- recent papers only, foundational/seminal works, or both?

Workflow

Step 1: Search for Papers

Run via exec:

exa.js search --query "[research topic]" --category "research paper" --num-results 10

For recent papers only, add a date filter:

exa.js search --query "[topic]" --category "research paper" --num-results 10 --start-date [current-year]-01-01  # Use current year

Step 2: Refine the Search

If results are too broad, narrow with specific terms:

exa.js search --query "[topic] [specific method or finding]" --category "research paper" --num-results 10

Step 3: Fetch Paper Content

For the most relevant results, fetch content to read abstracts and key sections:

exa.js contents --ids "[id1],[id2]" --text --highlights

Use the IDs returned from the search results.

Step 4: Synthesize Key Findings

Summarize the papers in the context of the user's research question. Highlight agreements and disagreements across papers.


Dry Run

To preview the request without making an API call:

exa.js search --query "[topic]" --category "research paper" --dry-run

Output Format

For each paper found:

  • Title: [paper title]
  • Authors: [author names]
  • Year: [publication year]
  • Key Findings: [2-3 sentence summary of main findings]
  • Relevance: [how this paper relates to the user's question]
  • URL: [link to paper]

After listing papers, provide a Synthesis section:

  • Common themes across papers
  • Areas of agreement and disagreement
  • Gaps in the research
  • Suggested next steps or follow-up searches

Tips

  • Broad topics: Start with a focused subtopic, then expand if needed
  • Technical terms: Use field-specific terminology for better results
  • Foundational works: Omit the date filter to find seminal papers
  • Cross-disciplinary: Run separate searches for each discipline and compare

Related Skills

  • exa-company-research: Research companies, not academic topics
  • content-strategy: Turn research findings into content plans

Comments

Loading comments...