Exa

Neural web search via Exa AI. Search people, companies, news, research, code. Supports deep search, domain filters, date ranges.

Security Scan

The skill's scripts and SKILL.md are coherent for a neural web-search client that requires an Exa API key, but registry metadata omissions and the unknown source/homepage raise concerns you should verify before installing.

Purpose & Capability

Skill name/description (neural web search) match the included scripts which POST queries and URLs to https://api.exa.ai. However the registry metadata listed no required binaries or credentials while SKILL.md and scripts clearly require curl, jq, and an EXA API key (config file or EXA_API_KEY). This mismatch is an incoherence (likely sloppy packaging) but the requested items themselves are consistent with the stated purpose.

Instruction Scope

SKILL.md and the scripts limit actions to building JSON payloads and calling Exa's API endpoints. The scripts only read the declared credentials file (~/.clawdbot/credentials/exa/config.json) or EXA_API_KEY and do not attempt to read other system files or secret stores. They do send user-provided URLs and queries to an external service (expected for search/content extraction).

Install Mechanism

There is no install spec (instruction-only with bundled scripts), so nothing is downloaded or written automatically beyond the included script files. Risk from install mechanism is low, but running the scripts will contact external endpoints.

Credentials

The skill requires an API key for Exa (EXA_API_KEY or config file) which is proportionate to performing API calls. The incoherence is that the registry metadata did not declare required env vars/binaries while SKILL.md and scripts do—this discrepancy should be resolved before trust. No unrelated credentials or wide secret access are requested.

Persistence & Privilege

The skill does not request always:true and does not attempt to modify other skills or system settings. It only reads its own config file in the user's home directory.

What to consider before installing

This skill appears to be a simple client that sends search queries and URLs to api.exa.ai and needs curl, jq, and an Exa API key stored at ~/.clawdbot/credentials/exa/config.json or EXA_API_KEY. Before installing: (1) verify the publisher/source and confirm api.exa.ai is the legitimate API endpoint for the vendor you expect (no homepage is provided), (2) confirm you trust sending your queries and any URLs (including potentially sensitive pages) to that external service, (3) ensure curl and jq are available, and (4) prefer creating and protecting a dedicated API key with limited scope. The main red flag is the registry metadata mismatch (it doesn’t list required bins or credentials) — this can be innocent packaging error but also indicates the publisher may be sloppy; if you need higher assurance, request the skill's provenance or an official homepage before use.

Exa - Neural Web Search

Powerful AI-powered search with LinkedIn, news, research papers, and more.

Setup

Create ~/.clawdbot/credentials/exa/config.json:

{"apiKey": "your-exa-api-key"}

Commands

General Search

bash scripts/search.sh "query" [options]

Options (as env vars):

• NUM=10 - Number of results (max 100)
• TYPE=auto - Search type: auto, neural, fast, deep
• CATEGORY= - Category: news, company, people, research paper, github, tweet, pdf, financial report
• DOMAINS= - Include domains (comma-separated)
• EXCLUDE= - Exclude domains (comma-separated)
• SINCE= - Published after (ISO date)
• UNTIL= - Published before (ISO date)
• LOCATION=NL - User location (country code)

Examples

# Basic search
bash scripts/search.sh "AI agents 2024"

# LinkedIn people search
CATEGORY=people bash scripts/search.sh "software engineer Amsterdam"

# Company search
CATEGORY=company bash scripts/search.sh "fintech startup Netherlands"

# News from specific domain
CATEGORY=news DOMAINS="reuters.com,bbc.com" bash scripts/search.sh "Netherlands"

# Research papers
CATEGORY="research paper" bash scripts/search.sh "transformer architecture"

# Deep search (comprehensive)
TYPE=deep bash scripts/search.sh "climate change solutions"

# Date-filtered news
CATEGORY=news SINCE="2026-01-01" bash scripts/search.sh "tech layoffs"

Get Content

Extract full text from URLs:

bash scripts/content.sh "url1" "url2"