Echo - OpenClaw Perplexity Ultimate Async Deep Researcher

• Analyzed: May 11, 2026, 4:58 AM
• Findings: 1
• Version: 1.0.0
• Hash: d16abd81b2c30dc26192243dc57cbc1d629aec6588b816aa5baa2d1018d446c5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the use of `subprocess.check_call` in `SKILL.md` for auto-installing dependencies. While used for a seemingly benign purpose (installing `perplexityai`), this method grants the skill the capability to execute arbitrary shell commands, which represents a significant vulnerability (potential RCE) if the arguments were not hardcoded or if the environment were compromised. There is no clear evidence of intentional malicious behavior such as data exfiltration or backdoor installation.