Echo - OpenClaw Perplexity Ultimate Async Deep Researcher

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:53 AM UTC
• Version: 1.0.0

Overview

This research skill does what it says, but it automatically installs an unpinned Python package at runtime while using a Perplexity API key, which deserves review before use.

Install only in a sandboxed environment where runtime package installation is acceptable, or preinstall and pin the Perplexity SDK yourself before enabling the skill. Do not use it for sensitive, confidential, or regulated research topics unless you are comfortable sending those queries to Perplexity. Keep `PERPLEXITY_API_KEY` scoped to this use and avoid exposing unrelated secrets in the same runtime.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Third-Party Package Installed at Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–32
Vulnerability Type: Unpinned runtime dependency installation
Risk Level: Medium

Vulnerable Code

python

# Auto-install dependency to ensure zero-setup for the user
try:
    from perplexity import AsyncPerplexity
except ImportError:
    print("Installing perplexityai...")
    subprocess.check_call([sys.executable, "-m", "pip", "install", "perplexityai", "-q"])
    from perplexity import AsyncPerplexity

Technical Analysis

The Skill instructs the agent to install perplexityai from the default Python package index whenever the module is unavailable. The dependency has no pinned version, cryptographic hash, lockfile, or verified package source. Consequently, the code reviewed in the Skill does not fully define the code that will execute at runtime.

Package installation and import can execute package-controlled code with the same permissions as the Python process. A compromised package release, compromised transitive dependency, or unexpected future update could therefore access resources available to the agent. This is especially sensitive because the runtime is expected to expose PERPLEXITY_API_KEY.

Although installing the official client supports the declared research functionality, automatic unverified installation is not the minimum-privilege implementation. The dependency should be provisioned and audited before the Skill runs.

Attack Path

1. An attacker compromises a future perplexityai release or one of its transitive dependencies.
2. A user invokes the Skill in an environment where the perplexity module is not installed.
3. The ImportError handler executes pip install perplexityai without a version or hash constraint.
4. The compromised package or dependency executes installation-time or import-time code with the agent process's permissions.
5. That code accesses available resources, potentially includ ...[truncated 808 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic package installation from the Skill execution workflow.
2. Preinstall the dependency in a controlled, sandboxed runtime image.
3. Pin the dependency and all transitive dependencies to reviewed versions using a lockfile.
4. Require cryptographic hashes, such as pip's --require-hashes, for every downloaded artifact.
5. Use an approved package repository or internal mirror with provenance and integrity controls.
6. Scan and review dependency updates before deployment rather than resolving the latest release at runtime.
7. Run the Skill as an unprivileged user with a read-only filesystem wherever practical.
8. Restrict network egress to the package source during image construction and to the required Perplexity API endpoint during execution.
9. Expose PERPLEXITY_API_KEY only to the search process and avoid placing unrelated credentials in the same environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly advertises automatic dependency installation through an internal Python tool with no prominent warning that this causes code execution, package retrieval from the network, and modification of the runtime environment. In an agent skill context, this is security-relevant because users may enable the skill expecting research functionality, while the framework may also perform package installation implicitly and non-interactively.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

🛠 Installation

Create a new directory in your OpenClaw skills folder:

bash

mkdir -p ~/.openclaw/skills/echo-perplexity-ultimate-async-researcher

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to send user-formulated research queries and receive results from the external Perplexity API, but it does not clearly warn the user that their prompts and related data will leave the local environment. This can expose sensitive user requests, proprietary topics, or regulated data to a third-party service, especially because the skill says it MUST use the API before answering.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to perform a runtime pip install from the network before executing research. This creates a supply-chain and arbitrary code execution risk because package contents and transitive dependencies are fetched dynamically at run time, outside a pinned and reviewed dependency boundary. The research context does not require zero-trust bypasses like self-installing code, so this is unjustified and materially increases exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill requires a sensitive credential (PERPLEXITY_API_KEY) but provides no user-facing guidance on safe handling, scope, or exposure risks. While simply requiring an API key is common, the lack of warning increases the chance of accidental misuse, especially in environments where skills may log, inherit, or broadly expose environment variables.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.