T08 · Insecure Dependencies
Warning
- Location
SKILL.md:9- Finding
Unpinned Executable Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
Perplexity
Security checks for vulnerabilities and agentic risk
Overview
This Perplexity gateway skill matches its stated purpose, but it asks users to install unpinned executable packages and silently falls back to a shared gateway key when no user key is set.
Review before installing. Use an isolated environment, avoid global installation, pin dependency versions where possible, set your own DEEPNLP_ONEKEY_ROUTER_ACCESS key, and do not send sensitive prompts or internal data through the demo fallback key.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/perplexity_ask.py:8- Finding
Hardcoded Shared Gateway Access Key Used as a Silent Fallback
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares environment-variable use and file/script execution guidance but does not define an explicit permission or allowed-tools scope. In agent ecosystems, missing scope boundaries can let a host grant broader capabilities than users expect, increasing the chance of unintended secret access or file reads during execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Encouraging fallback to a shared demo API key can expose user prompts, outputs, metadata, and usage patterns to a third-party shared account, with possible logging, quota exhaustion, and cross-tenant privacy issues. In this skill context, users are likely to submit arbitrary research queries or sensitive internal questions, making the shared-key design more dangerous than a simple documentation mistake.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
Using
npx onekeywithout a pinned package version causes the latest package to be resolved at runtime, which creates a supply-chain risk if a future release is compromised or introduces unsafe behavior. Because this skill is explicitly instructing users to execute the command, the trust boundary extends to an unpinned external package.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
Using
npx onekeywithout a pinned package version causes the latest package to be resolved at runtime, which creates a supply-chain risk if a future release is compromised or introduces unsafe behavior. Because this skill is explicitly instructing users to execute the command, the trust boundary extends to an unpinned external package.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
Using
npx onekeywithout a pinned package version causes the latest package to be resolved at runtime, which creates a supply-chain risk if a future release is compromised or introduces unsafe behavior. Because this skill is explicitly instructing users to execute the command, the trust boundary extends to an unpinned external package.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
Using
npx onekeywithout a pinned package version causes the latest package to be resolved at runtime, which creates a supply-chain risk if a future release is compromised or introduces unsafe behavior. Because this skill is explicitly instructing users to execute the command, the trust boundary extends to an unpinned external package.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code embeds a default access key value in
os.getenv(..., "BETA_TEST_KEY_MARCH_2026"), which creates a hardcoded credential fallback if the environment variable is absent. Hardcoded or fallback secrets are dangerous because they can be extracted from source, reused unintentionally across deployments, and may grant unauthorized access to the external routing service.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code forwards the user-provided payload to an external router via
router.invoke, which is a network/data-transmission operation. While the CLI arguments describe input sources, there is no confirmation prompt, warning message, or explanatory comment/docstring disclosing that supplied data will be sent to an external service.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script forwards the user-supplied payload directly to a remote router service via
router.invoke(...)without any disclosure, confirmation, redaction, or restriction on the contents ofmessages. This can unintentionally exfiltrate sensitive prompts, secrets, personal data, or internal content to an external service, which is especially relevant for an auto-generated agent skill that may be reused in larger workflows.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script sends the entire user-provided
payloadto an external router viarouter.invoke(...), which is a network/data-transmission operation. While the CLI arguments indicate input sources, there is no confirmation prompt, warning message, comment, or docstring disclosing that provided data will be transmitted to an external service.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script forwards the entire user-provided
payloadtorouter.invoke, which is a network/API operation, but there is no confirmation prompt, warning message, or explanatory comment/docstring telling the user that their query data will be transmitted externally. For a code file, this matches the missing-warning criterion for network calls that transmit user data.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation says the scripts may fall back to a demo API key when no user key is provided, while the manifest marks the key as required. This inconsistency can cause users to unknowingly send prompts and data through a shared credential path, undermining clear consent and predictable security behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The code reads
DEEPNLP_ONEKEY_ROUTER_ACCESS, which appears to be an access credential for the external router. There is no comment, docstring, or user-facing message explaining that the script depends on and consumes a sensitive credential, which reduces transparency for operators reviewing the skill's behavior.- Content
Static analysis
No suspicious patterns detected.