Perplexity Search Skill

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Searches run under the user's Perplexity account and may consume API quota or incur usage-based charges.

Why it was flagged

The script reads the user's Perplexity API key from the environment and uses it as a bearer token for API requests. This is expected for the stated search purpose, but it is still account-authorized access.

Skill content

api_key = os.environ.get("PERPLEXITY_API_KEY") ... "Authorization": f"Bearer {api_key}"

Recommendation

Use a dedicated or revocable Perplexity API key if possible, store it securely, and monitor Perplexity API usage.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Search terms may reveal interests, research topics, or business context to the Perplexity API provider.

Why it was flagged

The user's search query is sent to Perplexity's external API. This is central to the skill's purpose and is clearly disclosed, but it creates an external data flow.

Skill content

url = "https://api.perplexity.ai/search" ... payload = {"query": query, "max_results": min(max(count, 1), 10)}

Recommendation

Avoid putting secrets or highly sensitive private information into search queries, and review Perplexity's data handling terms if that matters for your use case.