ClawHub
Back to skill

Security audit

perplexity-research-aisa

Security checks for vulnerabilities and agentic risk

Overview

This research skill is not malicious, but it needs review because its bundled client can perform broader external search and URL extraction than the skill description clearly discloses.

Review before installing. Use this only if you are comfortable sending research prompts, URLs, and retrieved result content to AISA-backed external APIs, and avoid entering secrets, private documents, internal URLs, or sensitive business data. The publisher should either document the full multi-search and extraction surface or narrow the script to the advertised Perplexity research workflow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description frames the skill as a citation-backed research assistant, but the detected behavior includes broader search, arbitrary URL extraction, aggregation, and additional search backends. That mismatch is dangerous because users and policy systems may authorize the skill under a narrow trust model while it can actually fetch and process much broader external content, enabling data exfiltration, policy bypass, or unreviewed network activity.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
## When NOT to Use

- Do not use this skill for browser-cookie extraction, passwords, Keychain access, or other local sensitive credential access.
- Prefer a different skill when the user request is outside this skill's domain.

## Capabilities

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares executable behavior that uses environment variables and likely network access, but it does not explicitly define a tool scope such as permissions or allowed-tools. This creates an authorization gap where the runtime capabilities exceed what is transparently declared, increasing the risk of unintended outbound requests or secret exposure through the AISA_API_KEY-backed client.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest describes a focused capability: producing citation-backed research answers through Perplexity Sonar models. However, the file implements additional commands for generic web search, scholar search, Tavily search, multi-source aggregation, and direct URL extraction, which materially broaden the skill beyond the stated Perplexity-centric research scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_client.py (reported line 28)May include surrounding context.

python
from concurrent.futures import ThreadPoolExecutor, as_completed
from typing import Any

AISA_BASE = "https://api.aisa.one/apis/v1"


def get_api_key() -> str:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

User queries are sent to third-party APIs, and in the multi-source/synthesis flow the collected results are also retransmitted for explanation. Without an explicit warning or consent mechanism, users may unknowingly disclose sensitive prompts, URLs, or extracted content to external services, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest positions the skill as a research-answer generator using Perplexity Sonar models, where search and synthesis are expected. The extract command instead performs raw content extraction from arbitrary URLs and prints page content, which is a separate scraping/retrieval capability not justified by the stated Perplexity-answering role.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest sets the skill language to "en", which is a natural-language locale constraint. In this file there is no indication that users can opt into another language or that the English-only setting is justified by a region-specific or compliance-related purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The verity synthesis request hard-codes "language": "en", which imposes a specific language/locale on generated output. There is no opt-in, user-selectable language parameter, or documented reason that this command must always produce English summaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.