Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Echo - OpenClaw Perplexity Ultimate Async Deep Researcher
v1.0.0Perform deep, concurrent web research using the Perplexity Search API.
⭐ 0· 332·0 current·0 all-time
byChris Lee@holygrass
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, required binary (python3), and the single required env var (PERPLEXITY_API_KEY as primary credential) are consistent with a skill that queries the Perplexity Search API for research data.
Instruction Scope
SKILL.md confines behavior to: formulate 3–5 queries, run the provided Python script, parse JSON output, and synthesize/cite results. It does not ask to read unrelated files or environment variables. However, it explicitly mandates running the provided script (including pip install via subprocess) which grants the agent the ability to install and execute additional code at runtime—this expands the attack surface beyond simple API calls.
Install Mechanism
There is no install spec in the registry metadata, but the runtime script auto-installs the 'perplexityai' package by invoking 'pip install' via subprocess. This performs network fetches and writes packages to disk at runtime (moderate supply-chain risk). Installing from PyPI is common, but runtime auto-install is a hidden install behavior that may be unexpected in sandboxed or audited environments and is susceptible to typosquatting or malicious package replacement.
Credentials
The skill requires only PERPLEXITY_API_KEY and accesses only that environment variable in the script. No unrelated secrets, config paths, or additional credentials are requested.
Persistence & Privilege
The skill is not marked 'always' and does not request persistent system-wide changes. Still, its runtime behavior (pip installing a package and executing Python code via subprocess) requires write/network privileges in the execution environment; users running in shared/sensitive environments should be cautious.
What to consider before installing
This skill appears to do what it claims (run Perplexity searches) but requires the agent to install a PyPI package at runtime and execute Python subprocesses. Before installing or enabling it: (1) Decide whether you trust runtime pip installs in your environment—consider pre-installing the 'perplexityai' SDK in a controlled image. (2) Run the skill in a network-restricted sandbox or environment with limited filesystem impact if possible. (3) Ensure your PERPLEXITY_API_KEY has appropriate scope and rotate it if you later stop using the skill. (4) If you need stronger assurance, ask the skill author for an explicit install spec (package source, checksums) or provide the dependency yourself and remove the auto-install step.Like a lobster shell, security has layers — review code before you run it.
latestvk97dppbd69c76df3ywmfr6ph0x8206yt
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspython3
EnvPERPLEXITY_API_KEY
Primary envPERPLEXITY_API_KEY