The web-search skill is vulnerable to SSRF and exposes API keys in URL parameters, risking internal network access and credential compromise.
Claims to do
Exa — Neural Web Search & Research: Exa is a neural search engine. Unlike keyword-based search, it understands meaning — you describe the page you're looking for and it finds it. Returns clean, LLM-ready content with no scraping needed.
Actually does
This skill interacts with the Exa MCP server at `https://mcp.exa.ai/mcp` to perform neural web searches, extract clean content from specified URLs, and conduct specialized research (e.g., company, people, code context). It uses various tools like `web_search_exa`, `crawling_exa`, and `deep_search_exa`, optionally leveraging an API key for advanced features and higher rate limits.
openclaw skills install theishangoswami/web-search-exaThe `crawling_exa` tool allows fetching content from any specified URL. This capability could be abused by a malicious agent to perform Server-Side Request Forgery (SSRF) against the backend service, potentially probing internal network resources or cloud metadata endpoints if the service's URL validation is insufficient.
crawling_exa { "url": "https://arxiv.org/abs/2301.07041" }The skill instructs users to pass the API key as a URL query parameter. This method can increase the risk of the key being exposed in server logs, browser history, or network traffic compared to using HTTP headers.
https://mcp.exa.ai/mcp?exaApiKey=YOUR_EXA_KEY
[](https://mondoo.com/ai-agent-security/skills/clawhub/theishangoswami/web-search-exa)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/theishangoswami/web-search-exa"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/theishangoswami/web-search-exa.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/theishangoswami/web-search-exa.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.