ClawHub
Back to skill

Security audit

Perplexity Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Perplexity web-search helper that sends the user's query to Perplexity using a disclosed API key requirement.

Install only if you are comfortable providing a Perplexity API key and having search queries sent to Perplexity. Avoid using it for private or sensitive queries unless that fits your data-sharing expectations for the provider.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tainted flow: 'headers' from os.environ.get (line 13, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}

    try:
        response = requests.post(url, headers=headers, json=payload)
        response.raise_for_status()
        data = response.json()
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs execution of a local Python script that uses both network access and an environment-provided API key, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization and review gap: an agent may invoke code, read sensitive environment data, and make outbound requests without the skill manifest clearly constraining or disclosing those capabilities.

External Transmission

Medium
Category
Data Exfiltration
Content
print(json.dumps({"success": False, "error": "PERPLEXITY_API_KEY environment variable not set"}))
        return

    url = "https://api.perplexity.ai/v1/agent"
    headers = {
        "Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json"
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
}

    try:
        response = requests.post(url, headers=headers, json=payload)
        response.raise_for_status()
        data = response.json()
Confidence
80% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.