mcp-exa-search

SUSPICIOUS: The Exa endpoint is legitimate, but the skill's required installation path is not proportionate or trustworthy because it depends on an unrelated, personally published mh CLI installed via curl|sh. That supply-chain issue, plus possible credential forwarding and web-content prompt injection exposure, makes the skill high risk despite a plausible stated purpose.