ClawHub
Back to skill

Security audit

Exa Research

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Exa research skill, but review is warranted because its wrapper can pass the Exa API key to whichever executable `EXA_BIN` or `PATH` selects.

Install only if you trust the Exa CLI binary, your `PATH`, and any `EXA_BIN` or `EXA_API_KEY_FILE` configuration. Prefer OpenClaw-managed secrets or a locked-down key file, and avoid letting untrusted projects or shell environments control the executable path used by this skill.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/exa-with-key.sh:4
Finding

User-selectable executable receives the Exa API key

Content
View full analysis
/dev/null)"; then echo "Missing Exa binary on PATH: ${EXA_BIN:-exa}" >&2 echo "Install Exa from the upstream project or set EXA_BIN to its full path." >&2 exit 1 fi fi if [[ ! -x "$EXA_BIN" ]]; then echo "Missing or non-executable Exa binary: $EXA_BIN" >&2 exit 1 fi # Preferred auth source order: # 1. Existing EXA_API_KEY in the environment # 2. EXA_API_KEY_FILE override # 3. Default local credential file path if [[ -z "${EXA_API_KEY:-}" ]]; then if [[ ! -f "$EXA_API_KEY_FILE" ]]; then cat >&2 <' > "$EXA_API_KEY_FILE" chmod 600 "$EXA_API_KEY_FILE" EOF exit 1 fi if [[ ! -r "$EXA_API_KEY_FILE" ]]; then echo "Unreadable Exa API key file: $EXA_API_KEY_FILE" >&2 exit 1 fi EXA_API_KEY="$(head -n 1 "$EXA_API_KEY_FILE" | tr -d '\r\n')" fi if [[ -z "$EXA_API_KEY" ]]; then echo "Exa API key is empty. Set EXA_API_KEY, provide a non-empty key file, or configure skills.entries.exa-research.apiKey." >&2 exit 1 fi export EXA_API_KEY exec "$EXA_BIN" "$@" ``` ### Technical Analysis The wrapper permits the `EXA_BIN` environment variable to select an arbitrary executable. If no path separator is present, the name is resolved through the ...[truncated 2193 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

A common default is:

bash
mkdir -p ~/.openclaw/skills
cp -R exa-research-openclaw-skill ~/.openclaw/skills/exa-research
chmod 700 ~/.openclaw/skills/exa-research/scripts/exa-with-key.sh

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

bash
mkdir -p ~/.openclaw/skills
cp -R exa-research-openclaw-skill ~/.openclaw/skills/exa-research
chmod 700 ~/.openclaw/skills/exa-research/scripts/exa-with-key.sh

Secure credential setup

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 118)May include surrounding context.

bash
mkdir -p ~/.openclaw/credentials/exa
printf '%s\n' '<your-exa-api-key>' > ~/.openclaw/credentials/exa/api-key.txt
chmod 600 ~/.openclaw/credentials/exa/api-key.txt

You can also point somewhere else:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill clearly instructs the agent to invoke a local shell wrapper ({baseDir}/scripts/exa-with-key.sh) and therefore has command-execution capability, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege enforcement and can let the skill be used in environments where shell access was not clearly intended or reviewed, increasing the chance of command misuse or unintended data exposure through CLI/network operations.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 131)May include surrounding context.

md
Recommended file setup:
  mkdir -p "$(dirname "$EXA_API_KEY_FILE")"
  printf '%s\n' '<your-exa-api-key>' > "$EXA_API_KEY_FILE"
  chmod 600 "$EXA_API_KEY_FILE"
EOF
    exit 1
  fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/exa-with-key.sh (reported line 39)May include surrounding context.

sh
Recommended file setup:
  mkdir -p "$(dirname "$EXA_API_KEY_FILE")"
  printf '%s\n' '<your-exa-api-key>' > "$EXA_API_KEY_FILE"
  chmod 600 "$EXA_API_KEY_FILE"
EOF
    exit 1
  fi

Static analysis

No suspicious patterns detected.