Exa Search

• Analyzed: May 14, 2026, 3:24 AM
• Findings: 1
• Version: 1.0.0
• Hash: 1a5bc9035f635d231957d0e373dafb9a590cc91665386825554ecb0acd7d91c7
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to interact with the Exa Search API, as stated in its description. The `SKILL.md` provides clear instructions for usage and does not contain any prompt injection attempts. The `scripts/exa_search.mjs` script correctly retrieves the `EXA_API_KEY` from environment variables, constructs a JSON request body from validated arguments, and sends it to the legitimate Exa API endpoint (`https://api.exa.ai/search`). There is no evidence of data exfiltration, malicious execution, persistence, or obfuscation. All actions are aligned with the stated purpose.