ClawHub
Back to skill

Security audit

Perplexity Research

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Perplexity research helper; users should understand that prompts go to an external API and dependencies are not pinned.

Install this only if you are comfortable sending research prompts and any supplied context to Perplexity. Avoid using it with secrets, regulated data, proprietary source, or precise location unless approved, keep the API key out of version control, and consider pinning dependencies in a locked requirements file before production use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
manifest.yaml:30
Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: manifest.yaml:30-33
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

yaml
dependencies:
  python:
    - perplexity>=1.0.0
    - python-dotenv>=0.19.0

Related installation instructions appear in README.md:22 and reference.md:521:

bash
pip install perplexity python-dotenv

Technical Analysis

The dependency declarations use unrestricted lower bounds, while the documented installation command specifies no versions or integrity hashes. Consequently, future installations may resolve to package versions that were not present during this audit.

Python packages can execute package-controlled code during installation, and their modules execute code when imported. This project imports both dependencies in scripts/perplexity_client.py. A compromised upstream release, package-index compromise, or malicious transitive dependency could therefore execute arbitrary code in the Skill's environment.

The audit found no evidence that the currently declared package names are intentionally malicious. The vulnerability is the mutable and unverifiable dependency resolution process.

Attack Path

  1. An attacker compromises a future release of perplexity, python-dotenv, or one of their transitive dependencies, or compromises the package index used by the installer.
  2. A user follows the documented command or installs the dependencies from manifest.yaml.
  3. The package manager resolves a malicious or otherwise unreviewed version because no exact version or hash is required.
  4. Malicious package code executes during installation or when perplexity_client.py imports the package.
  5. That code runs with the privileges of the user or service operating the Skill and can access files, environment variables, and network resources available to that process.

Impact Assessment

Successful exploitation provides arbitrary code execution with the privileges o ...[truncated 412 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace lower-bound dependency constraints with exact, reviewed versions.

  2. Generate and commit a lock file that includes all transitive dependencies.

  3. Record cryptographic hashes for every distributable package and install with hash verification, for example:

    bash
    python -m pip install --require-hashes -r requirements.txt

  4. Update README.md and reference.md to direct users to the locked, hash-verified dependency file rather than installing unconstrained package names.

  5. Explicitly configure and document the trusted Python package index.

  6. Perform dependency vulnerability and provenance checks before updating locked versions.

  7. Test dependency updates in an isolated environment before publishing them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

Create .env file in the scripts/ directory:

bash
cd .cursor/skills/perplexity-research/scripts
cp .env.example .env
# Edit .env and add your actual API key

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

md
from typing import Optional, List, Dict
from perplexity import Perplexity, APIError

# Try to load .env file if it exists
try:
    from dotenv import load_dotenv
    # Look for .env in the script's directory

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.yaml (reported line 85)May include surrounding context.

yaml
from typing import Optional, List, Dict
from perplexity import Perplexity, APIError

# Try to load .env file if it exists
try:
    from dotenv import load_dotenv
    # Look for .env in the script's directory

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · reference.md (reported line 414)May include surrounding context.

md
from typing import Optional, List, Dict
from perplexity import Perplexity, APIError

# Try to load .env file if it exists
try:
    from dotenv import load_dotenv
    # Look for .env in the script's directory

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/perplexity_client.py (reported line 19)May include surrounding context.

python
from typing import Optional, List, Dict
from perplexity import Perplexity, APIError

# Try to load .env file if it exists
try:
    from dotenv import load_dotenv
    # Look for .env in the script's directory

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/perplexity_client.py (reported line 22)May include surrounding context.

python
from typing import Optional, List, Dict
from perplexity import Perplexity, APIError

# Try to load .env file if it exists
try:
    from dotenv import load_dotenv
    # Look for .env in the script's directory

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/perplexity_client.py (reported line 23)May include surrounding context.

python
try:
    from dotenv import load_dotenv
    # Look for .env in the script's directory
    env_path = Path(__file__).parent / '.env'
    if env_path.exists():
        load_dotenv(env_path)
except ImportError:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README states the skill will 'automatically use' Perplexity for research/current-information requests, but it does not define clear activation boundaries or require explicit confirmation before external API use. In an agent context, this can cause over-broad invocation and unintended transmission of user prompts or sensitive workspace context to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README describes automatic web/API usage but does not warn that user queries and possibly surrounding context will be sent to an external provider. In a coding-agent environment, this omission is risky because users may assume local-only processing and unknowingly disclose confidential information to Perplexity or searched websites.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents use of environment-based secrets (PERPLEXITY_API_KEY) and external API access, but the manifest shown in SKILL.md does not declare any tool scope such as permissions or allowed-tools. That mismatch weakens security review and user/admin awareness because the skill can appear less capable than it actually is, increasing the chance of unintended secret access or unvetted external calls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description says to use the skill for 'comprehensive research on any topic requiring web search and reasoning capabilities,' which is broad enough to match many routine prompts. Overly broad invocation language can cause the skill to trigger in situations where users did not intend to send their query to an external research provider, creating avoidable data exposure and scope creep.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation presents the skill as a research assistant with web search and Perplexity API usage but does not clearly warn users that prompts and possibly conversation context may be sent to an external API and web search provider. In a research skill, this omission is especially risky because users may paste proprietary, personal, or regulated information while expecting only local processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The example sends both free-form user queries and structured location data to an external research service without an explicit notice that this information leaves the local environment. This can lead users to disclose sensitive prompts, proprietary topics, or precise location context to a third party without informed consent, which is a real privacy and data-handling risk in a research skill built around external web/API access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest describes a skill for conducting deep research via the Perplexity API with web search and reasoning, which implies querying and returning analysis. In the 'Research Report Generator' example, the code additionally persists generated content to an arbitrary local file via open(output_file, 'w'), introducing local file-write behavior not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation encourages use of web-enabled queries and optional location metadata but does not disclose that prompts and location context are transmitted to the external Perplexity API. In a research skill, users may submit sensitive business, personal, or regulated data, so the omission creates a real data exposure risk through uninformed use rather than direct code execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation instructs users to place an API key in a .env file but gives no guidance on protecting that file, excluding it from version control, or using safer secret-management options. This can lead to accidental credential disclosure through commits, backups, logs, or shared skill directories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The search path sends the user's raw query to Perplexity and enables a remote web_search tool without any explicit user-facing notice at the point of use. In a research skill, this creates a real privacy/data-handling risk because users may unknowingly transmit sensitive prompts or proprietary information to external services and web search providers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Research mode always performs a remote API request with web_search enabled and encourages multiple searches, but does not clearly warn the user that their research prompt will be transmitted externally. This is especially relevant in a deep-research skill, where prompts are more likely to contain confidential business, legal, medical, or investment context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The report-generation example writes output to a user-specified local filename without warning that an existing file may be created or overwritten. Although the code is straightforward and not covertly destructive, documentation that omits this warning can still cause accidental data loss or unintended file creation when copied by users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.