ClawHub
Back to skill

Security audit

perplexity-downloader

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but it deserves Review because it can collect and permanently save a user's full Perplexity history with limited privacy warnings or export controls.

Install only if you are comfortable letting the agent process and save Perplexity conversations locally. Prefer giving explicit thread URLs instead of pasting a logged-in home page, review pasted content for sensitive details first, and choose where/how to store or delete the generated archive.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Context Leakage

High
Category
Data Exfiltration
Confidence
95% confidence
Finding

The instruction to have the user copy/paste their logged-in Perplexity home page or provide the home-page URL creates a real context-leakage risk because the pasted content may include far more than thread links, potentially exposing private history, account context, and other sensitive page data. In this skill's context, the danger is elevated because the next steps explicitly parse and archive that data at scale.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
1. **Get History Page** → Ask user to do one of:
   - Visit `https://www.perplexity.ai/` (logged in), scroll history sidebar to load all threads, copy/paste the page
   - Or provide the URL to their Perplexity home page
2. **Extract Thread URLs** → Parse the content for all thread URLs (pattern: `https://perplexity.ai/search/...`)
   - Deduplicate
   - Report count: *"Found 42 threads in your history"*
3. **Download Each Thread Sequentially** → Loop through each URL:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger condition includes broad phrasing such as 'any request to capture Perplexity conversations,' which can cause the skill to activate on loosely related requests. In a skill that exports and saves conversation data, unintended invocation increases the chance of collecting or storing sensitive content the user did not explicitly intend to archive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The full-history export flow instructs saving large amounts of Perplexity conversation data to local Markdown files without a clear warning that those conversations may contain sensitive personal, business, or credential-like information. This omission creates a meaningful privacy and data-handling risk because users may not understand the scope or persistence of what is being archived.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill is designed to collect and archive the user's entire Perplexity history into local files, which may include sensitive prompts, answers, and linked sources. Even without malicious intent, bulk collection and persistent storage expand the exposure surface if the output directory is later accessed, synced, shared, or compromised.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manual fallback asks the user to paste full page text when automatic retrieval fails, which can expose private conversation contents directly to the agent workflow and lead to local storage of highly sensitive material. This increases the risk of overcollection because pasted page text may contain more information than needed, including unrelated account or browsing context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.