v1.0.0

Exa tools

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:53 AM.

Analysis

This instruction-only skill is coherently focused on Exa web and people research, with minor user-notice items around the Exa API key and hosted MCP queries.

GuidanceThis skill appears safe to use for Exa-based research if you are comfortable sending the relevant search queries to Exa. Protect the EXA_API_KEY, do not share generated configuration containing a real key, and verify the hosted endpoint against Exa's official documentation before use.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

metadata

Source: unknown; Homepage: none

The registry metadata does not provide a source repository or homepage for provenance review. The skill is instruction-only, so this is a low-impact provenance note rather than a behavioral concern.

User impactUsers have less publisher or source context to verify that the configuration matches the intended Exa MCP setup.

RecommendationBefore adding credentials, compare the endpoint and tool names against Exa's official documentation.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

references/exa-mcp-setup.md

https://mcp.exa.ai/mcp?exaApiKey=${EXA_API_KEY}&tools=web_search_exa,web_search_advanced_exa,people_search_exa

The skill documents use of an Exa API key in the hosted MCP endpoint. This is expected for Exa access, but it is still a credential that should be protected.

User impactIf the API key is exposed, someone else may be able to use the user's Exa account or quota.

RecommendationStore the Exa API key in a secure environment variable or secret store, avoid pasting it into chats or shared logs, and rotate it if it is accidentally exposed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

Prefer the hosted Exa MCP endpoint with fixed tools in the URL query.

The skill routes research through a hosted Exa MCP service. This is aligned with its purpose, but it means search prompts and people-research queries are sent to an external provider.

User impactResearch topics, names, organizations, or other query details may be visible to the Exa service.

RecommendationAvoid sending confidential or highly sensitive research queries unless Exa's data handling terms are acceptable for the task.