ClawHub
Back to skill

Security audit

Perplexity Sonar

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Perplexity/AIsa search skill that sends the user's chosen query to documented external API endpoints using an AISA API key.

Install only if you are comfortable sending selected search queries and optional system instructions to AIsa/Perplexity-backed services. Avoid including secrets, personal data, regulated content, or confidential business material unless your policy allows external processing, and keep the AISA_API_KEY scoped and rotated normally.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill declares required environment variables and instructs use of networked clients/curl, but does not declare explicit permissions for those capabilities. That creates a governance gap: operators may not realize the skill can access secrets and transmit user prompts or other data to an external service. In a skill that is specifically designed to call a third-party API, this omission is not inherently malicious, but it weakens review and consent controls.

External Transmission

Medium
Category
Data Exfiltration
Content
--system "Respond in markdown with an executive summary first."
```

## Curl Examples

### Sonar
Confidence
93% confidence
Finding
The curl examples instruct transmission of user-supplied content and an API bearer token to an external domain. External transmission is expected for a search skill, but it is still a real data-exposure boundary: sensitive prompts, system instructions, or embedded secrets could be sent off-platform if users or agents invoke the examples naively. The context makes this less suspicious than covert exfiltration, but still security-relevant because the skill normalizes sending data to a third party.

External Transmission

Medium
Category
Data Exfiltration
Content
### Sonar

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
95% confidence
Finding
This finding shows a concrete external endpoint that receives requests authenticated with AISA_API_KEY. Even though contacting api.aisa.one is the core purpose of the skill, the endpoint represents an outbound data path where prompts and possibly sensitive context leave the local environment. The risk is contextual and operational rather than overtly malicious, but it remains a true vulnerability surface if the skill is used with sensitive data.

External Transmission

Medium
Category
Data Exfiltration
Content
### Sonar Pro

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-pro" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
95% confidence
Finding
The Sonar Pro example again transmits query content to an external service using a bearer token. Because this mode may be used for stronger synthesis/comparison tasks, users may send larger and more sensitive internal context, increasing the chance of unintended disclosure. The skill context justifies the network call, but does not eliminate the need to treat it as a real exfiltration channel.

External Transmission

Medium
Category
Data Exfiltration
Content
### Sonar Reasoning Pro

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-reasoning-pro" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
95% confidence
Finding
The Sonar Reasoning Pro example sends analytical prompts to an external endpoint, which may encourage users to include detailed internal reasoning context, documents, or proprietary strategy. That expands the exposure risk beyond simple web search queries. While aligned with the skill's purpose, it is still a genuine outbound transmission concern and not merely a false positive.

External Transmission

Medium
Category
Data Exfiltration
Content
### Sonar Deep Research

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-deep-research" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
96% confidence
Finding
The Deep Research endpoint is an especially significant external transmission vector because it is intended for exhaustive reports and likely longer inputs, increasing the volume and sensitivity of data sent off-platform. Longer timeouts and retries can also repeat transmission attempts, compounding exposure if the payload is sensitive. The behavior is expected for the feature, but the skill context makes careful disclosure controls more important, not less.

Static analysis

No suspicious patterns detected.