Exa Research

Use the local `exa` CLI to search the live web, ask grounded questions with citations, fetch page contents, find similar links, retrieve Exa code context, or...

Security Scan

The skill's requirements, instructions, and included wrapper script are consistent with its stated purpose (invoking the local Exa CLI with an API key); nothing in the package appears disproportionate or malicious.

Purpose & Capability

Name/description claim: use the local `exa` CLI to perform live web research. Declared requirements: `exa` binary and EXA_API_KEY. Included wrapper script simply locates the exa binary and supplies an API key before exec'ing it. These are expected and proportional for the stated purpose.

Instruction Scope

SKILL.md instructs the agent to call the bundled wrapper with exa subcommands. The wrapper reads only the API key (from env or a single credential file path) and validates the exa binary. No instructions ask the agent to read unrelated files, secrets, or system state, nor to send data to unexpected endpoints.

Install Mechanism

This is an instruction-only skill with an included shell wrapper; there is no install script that downloads code from an external URL. The README instructs users to install Exa from its upstream repo. No risky remote downloads or archive extraction are present in the package.

Credentials

Only one credential is required (EXA_API_KEY), declared as primaryEnv. The wrapper supports a single credential file path and environment variable and documents them. The requested credential is consistent with Exa API usage and there are no unrelated secrets requested.

Persistence & Privilege

The skill does not request always: true and does not modify other skills or system-wide settings. It runs only when invoked. The agent may invoke it autonomously by default (disable-model-invocation: false), which is standard; combined with the narrow credential scope this is not an excessive privilege.

Assessment

This package appears coherent: it wraps and runs your installed Exa CLI and reads a single Exa API key from an environment variable or a single credential file. Before installing, verify you trust the upstream Exa binary (install from the linked GitHub release), keep the API key file permissions restricted (chmod 600), and confirm EXA_BIN points to the intended executable. Because the wrapper execs the exa binary, if your exa binary were replaced by a malicious program it could misuse the API key — so prefer official Exa releases and check checksums when available. If you run agents that can invoke skills autonomously, be aware they could call this skill and use the configured EXA_API_KEY to query Exa; that behavior is expected but note it if you are concerned about automated API usage or billing.

Use the bundled wrapper to run Exa reliably:

{baseDir}/scripts/exa-with-key.sh --help

Credentials

Preferred OpenClaw-native setup:

• skills.entries.exa-research.apiKey
• or skills.entries.exa-research.env.EXA_API_KEY

Other supported auth sources:

• ambient EXA_API_KEY
• EXA_API_KEY_FILE
• default file fallback at ~/.openclaw/credentials/exa/api-key.txt

The wrapper prefers credentials in this order:

1. existing EXA_API_KEY
2. EXA_API_KEY_FILE
3. the default file path above

Route to the smallest command that fits

• Use search for live web discovery and filtered result lists.
• Use answer for one grounded answer with citations.
• Use contents when URLs or result IDs are already known and text/highlights/summary are needed.
• Use similar when one seed URL is known and related pages are needed.
• Use context for coding patterns, library usage, and implementation examples.
• Use research for asynchronous or longer-running research workflows.
• Use raw only when a higher-level command cannot express the request.

Keep context lean

• Start narrow; broaden only if recall is poor.
• Prefer answer over manual search-plus-synthesis when the user wants a concise cited answer.
• Prefer highlights before full text when excerpts are enough.
• Cap payload size with --text-max, --highlights-max, and context --tokens.
• Add domains, categories, and date filters early instead of retrieving broad result sets.
• Do not dump large raw payloads into chat when a short synthesis will do.

Command patterns

Search

{baseDir}/scripts/exa-with-key.sh "latest developments in llms"
{baseDir}/scripts/exa-with-key.sh search --category news --include-domain reuters.com --highlights "AI regulation"
{baseDir}/scripts/exa-with-key.sh search --type deep --additional-query "llm releases" "latest frontier models"

Answer

{baseDir}/scripts/exa-with-key.sh answer "What is the latest valuation of SpaceX?"
{baseDir}/scripts/exa-with-key.sh answer --text "What changed in the latest OpenAI release?"

Contents

{baseDir}/scripts/exa-with-key.sh contents --text https://exa.ai
{baseDir}/scripts/exa-with-key.sh contents --id doc-1 --id doc-2 --highlights
{baseDir}/scripts/exa-with-key.sh contents --highlights --summary https://exa.ai https://example.com

Similar

{baseDir}/scripts/exa-with-key.sh similar --highlights https://arxiv.org/abs/2307.06435
{baseDir}/scripts/exa-with-key.sh similar --text --text-max 3000 https://exa.ai/blog

Context

{baseDir}/scripts/exa-with-key.sh context "React hooks for state management"
{baseDir}/scripts/exa-with-key.sh context --tokens 5000 "pandas dataframe filtering and groupby operations"

Research

{baseDir}/scripts/exa-with-key.sh research create "Summarize the latest developments in AI safety research"
{baseDir}/scripts/exa-with-key.sh research list --limit 10
{baseDir}/scripts/exa-with-key.sh research get 01jszdfs0052sg4jc552sg4jc5

Raw

{baseDir}/scripts/exa-with-key.sh raw /search @payload.json
{baseDir}/scripts/exa-with-key.sh raw -X GET '/research/v1?limit=10'
printf '{"query":"latest llm news"}' | {baseDir}/scripts/exa-with-key.sh raw /search -

Practical guidance

• Run {baseDir}/scripts/exa-with-key.sh <subcommand> --help before guessing flags.
• If the task is exploratory, start with search, then escalate to contents only for selected URLs.
• If the task is code-oriented, prefer context over broad search.
• If the task needs longer-running synthesis, prefer research over ad hoc polling with raw.
• If the user asks for the upstream generated skill text, run exa skill.