Perplexity Deep Search

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: perplexity-deep-search Version: 1.1.0 The OpenClaw skill bundle for Perplexity Deep Search is benign. It provides a legitimate wrapper for the Perplexity API, correctly handling API keys by prioritizing environment variables and falling back to a securely stored local file (`~/.config/perplexity/api_key`). The `scripts/search.sh` uses `jq` to safely construct JSON payloads for `curl` requests to the official `api.perplexity.ai` endpoint, mitigating injection risks. The `SKILL.md` documentation is clear and does not contain any prompt injection attempts or instructions for the OpenClaw agent to perform actions beyond the stated purpose. No evidence of data exfiltration, unauthorized execution, persistence, or obfuscation was found.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

The skill can use your Perplexity account credentials and may cause API usage charges, especially in research mode.

Why it was flagged

The script reads a Perplexity API key from a specific environment variable or local config file and uses it only as the Authorization header for Perplexity.

Skill content

KEY_FILE="${HOME}/.config/perplexity/api_key" ... PERPLEXITY_API_KEY=$(cat "$KEY_FILE") ... -H "Authorization: Bearer $PERPLEXITY_API_KEY"

Recommendation

Use a dedicated Perplexity API key if possible, keep the key file permission-restricted, and revoke the key if you stop using the skill.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Anything included in the search query is shared with Perplexity for processing.

Why it was flagged

The user’s query is placed into the request payload and sent to the external Perplexity API endpoint, which is consistent with the skill’s search purpose.

Skill content

messages: [ { role: "user", content: $content } ] ... curl -sS "https://api.perplexity.ai/chat/completions"

Recommendation

Avoid placing secrets, private documents, or sensitive personal data in queries unless you are comfortable sending them to Perplexity.