ClawHub
Back to skill

Security audit

perplexity-research-zh

Security checks across malware telemetry and agentic risk

Overview

This skill is not plainly harmful, but its included client can do broader remote search and URL extraction than the Perplexity Sonar description tells users.

Review before installing. Use it only if you are comfortable sending research prompts, URLs, and retrieved result data to AISA endpoints, and avoid private/internal URLs or sensitive content. Prefer a narrower Sonar-only skill if that is the capability you intended to grant.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares access to an API key and invokes a Python client that performs external network requests, but it does not explicitly declare permissions for those capabilities. This creates a transparency and governance gap: operators may approve or invoke the skill without understanding that it can use secrets from the environment and send data off-host.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The documented behavior says the skill generates cited research answers via Perplexity Sonar, but the detected capabilities include broader web, scholar, Tavily search, URL extraction, and synthesis endpoints. That mismatch is dangerous because it can expand the skill's effective data collection and outbound sharing beyond what users and reviewers expect, increasing the chance of sensitive prompt or content exfiltration to additional third-party services.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The file advertises a Perplexity Sonar deep-research skill, but the implementation exposes several additional capabilities including general web search, scholar search, Tavily search, extraction, and multi-source synthesis. This scope mismatch is dangerous because users and downstream policy controls may trust the skill for a narrow purpose while it can transmit broader user inputs to multiple external services.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The extract mode accepts arbitrary URLs and sends them to an external extraction endpoint, which goes beyond cited-answer generation and can retrieve raw page content. In an agent setting, this can exfiltrate sensitive internal URLs or user-provided private resources to a third party under the guise of a research skill.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The verity workflow performs parallel retrieval across multiple sources and then submits aggregated results for synthesis, which materially expands data sharing beyond a Sonar-only deep-research skill. This increases privacy and compliance risk because one query may be propagated to several providers and combined outputs may include more data than the user intended to disclose.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.