Perplexity Sonar via Openrouter in CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 1.0.0

Overview

This is a straightforward local CLI for OpenRouter-backed web search, with expected external API use and only user-directed file output.

Before installing, understand that searches, prompts, and optional system prompts are sent to OpenRouter for web-backed model responses. Use a scoped OpenRouter API key, avoid submitting secrets or regulated data, and choose `--output` paths carefully because the CLI writes directly to the named file.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Unvalidated Output Injection

High

• Category: Output Handling

Content

program.outputHelp();
      return;
    }
    await runQuery(query, opts.model, opts.format, opts.system, opts.output, opts.format);
  });

program

• Confidence: 85% confidence
• Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Unvalidated Output Injection

High

• Category: Output Handling

Content

.option('-s, --system <prompt>', 'optional system prompt')
    .action(async (queryParts, opts) => {
      const query = Array.isArray(queryParts) ? queryParts.join(' ').trim() : '';
      await runQuery(query, model, opts.format, opts.system || system, opts.output, opts.format);
    });
}

• Confidence: 85% confidence
• Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Session Persistence

Medium

• Category: Rogue Agent

Content

git clone https://github.com/iamjameskeane/openclaw-sonar.git
cd openclaw-sonar
chmod +x scripts/openrouter-sonar.ts
mkdir -p ~/.local/bin
ln -sf "$PWD/scripts/openrouter-sonar.ts" ~/.local/bin/sonar
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documents capabilities that use environment variables and make network-backed requests, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens user awareness and policy enforcement, making it easier for an agent to invoke the skill without clear disclosure that it will access secrets and send data externally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to supply an OpenRouter API key and use web-search-backed queries, but it does not clearly warn that prompts, search terms, and related data are transmitted to OpenRouter and potentially onward through search providers. Users may unknowingly send sensitive business data, credentials, or regulated information to third-party services.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The CLI sends user queries and optional system prompts directly to OpenRouter, which is an external service, but the script itself does not present a clear runtime disclosure or consent prompt before transmitting that data. In a local CLI that may be used on sensitive prompts, this creates a real privacy/data-handling risk because users may unknowingly send proprietary or confidential text off-host.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The skill advertises an --output option that writes results to local files, but it does not warn users that existing files may be overwritten. In agentic or scripted use, this can lead to accidental clobbering of local data or writing sensitive model output to an unintended path.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/openrouter-sonar.ts:19