The Agent Skills Directory

[SAFE]: The skill performs its stated purpose of searching the web via the Exa API. No malicious patterns such as prompt injection, obfuscation, or unauthorized data exfiltration were detected.
[EXTERNAL_DOWNLOADS]: The script fetches search results from https://mcp.exa.ai/mcp. This is a well-known search service and the core functionality of the skill.
[DATA_EXFILTRATION]: The skill transmits search queries and optional API keys to the Exa endpoint. This is the intended behavior of a search integration. API keys can be provided securely via environment variables or CLI arguments.
[INDIRECT_PROMPT_INJECTION]: As a search tool, this skill processes untrusted content from the internet.
Ingestion points: Search results are fetched from mcp.exa.ai via Node.js fetch.
Boundary markers: The script does not wrap search results in specific delimiters before outputting them to the agent.
Capability inventory: The script's capabilities are limited to making network requests via fetch.
Sanitization: Results are parsed as JSON/SSE and text content is extracted, but no content sanitization is performed on the returned text.

exa-search