ClawHub

Web Search by Exa

v2.0.0

Neural web search, content extraction, company and people research, code search, and deep research via the Exa MCP server. Use when you need to: (1) search t...

⭐ 42· 25k·48 current·48 all-time
byIshan Goswami@theishangoswami
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The name and description match the SKILL.md instructions: it configures an external Exa MCP server and exposes web-search and research tools. There are no unrelated binaries, env vars, or install steps requested that would be out of scope for a web-search integration.
ℹ
Instruction Scope
The instructions are narrowly focused on adding the Exa MCP server to the agent config and calling the listed tools. This is coherent for a remote search service. Important: using the skill causes your agent to send user queries (and in some tool modes, retrieved page contents) to the external MCP endpoint (https://mcp.exa.ai/mcp). The SKILL.md does not document privacy, retention, or what data the MCP will store, so there is a real data-exfiltration/privacy surface when used on sensitive queries.
✓
Install Mechanism
Instruction-only skill with no install spec and no code files. Nothing will be written to disk or automatically downloaded during install beyond the configuration change you choose to make — this is low-risk from an install perspective.
ℹ
Credentials
The skill declares no required env vars or credentials (proportionate). However it recommends adding an API key by appending exaApiKey as a query parameter to the MCP URL (e.g., https://mcp.exa.ai/mcp?exaApiKey=YOUR_EXA_KEY). Storing secrets in a URL may persist them in agent configs or logs and increases risk of accidental leakage. Prefer secret storage mechanisms if available.
✓
Persistence & Privilege
always:false and no special privileges are requested. The only persistent effect is adding an MCP server entry to your agent config (which is expected). Note that the skill allows normal autonomous invocation (disable-model-invocation:false), so if agent autonomy is enabled, the agent may call Exa tools without interactive confirmation.
Assessment
This skill appears to do what it says: it forwards queries to Exa's MCP server and returns search/extraction results. Before installing, verify the MCP URL (mcp.exa.ai) and Exa's authenticity (official docs / GitHub repo). Do not paste sensitive secrets directly into the MCP URL if you can avoid it — prefer storing API keys in a proper secrets store or agent-managed secret field. Consider the sensitivity of queries you will send: tools like crawling_exa and people_search_exa may transmit full page contents or personal profile data to Exa. Review Exa's privacy/retention policy and limit tool scope (disable optional tools you don't need) and enable the skill only for non-sensitive research unless you trust the service and key management practice.

Like a lobster shell, security has layers — review code before you run it.

latestvk976k97gp95chqrxh4y9tnra7182p6rb

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments