Perplexity Research

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent Perplexity research skill, but it uses an external API/web search, requires a Perplexity API key, and has some registry metadata under-declaration users should notice.

Before installing, confirm you are comfortable sending research prompts to Perplexity, using a Perplexity API key that may incur costs, and installing the documented Python dependencies. Avoid using the skill with confidential or regulated data unless your provider agreement and internal policy allow it.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Research queries may be sent to web search and may incur Perplexity API usage without a second confirmation after the skill is invoked.

Why it was flagged

The skill prompts the Perplexity model to invoke web search automatically after the skill method is used. This is central to current-information research, but it means there is no additional per-search approval.

Skill content
NEVER ask permission to search - just search when appropriate.
Recommendation

Use this only for intended research tasks, avoid sending private data unless acceptable, and consider adding explicit approval or cost limits for sensitive/high-volume use.

What this means

Anyone or any agent process with access to that key can use the associated Perplexity account within the key’s permissions and billing limits.

Why it was flagged

The skill requires a Perplexity API credential and optionally stores it locally in the skill folder. This is expected for the integration, but users should understand the account/billing authority being granted.

Skill content
Ensure `PERPLEXITY_API_KEY` is set: ... Or create `.env` file in the skill's `scripts/` directory
Recommendation

Use a scoped, rotatable API key; keep the .env file out of source control; and ensure deployment metadata declares the required secret.

What this means

Installing the skill’s dependencies could pull package versions that differ from what was originally tested or reviewed.

Why it was flagged

The documented setup installs third-party Python packages, but there is no registry install spec and the README command does not pin exact versions.

Skill content
pip install perplexity python-dotenv
Recommendation

Pin or lock dependency versions and reflect the dependency/API-key requirements in the registry install metadata.

What this means

Prompts, pasted context, and conversation content used for research may be processed by Perplexity and used with web search.

Why it was flagged

User-supplied research queries are sent to the Perplexity API with optional web_search tooling. This is the intended function, but it crosses an external provider/data boundary.

Skill content
response = self.client.responses.create(
                model=model,
                input=query,
                tools=tools,
Recommendation

Do not include secrets, regulated data, or confidential business material unless the provider terms and your organization’s policy allow it.