Perplexity Search Skill

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:42 AM UTC
• Version: 1.0.0

Overview

This is a straightforward Perplexity web-search skill that sends search queries to Perplexity using a user-provided API key, with no evidence of hidden persistence, deception, or unrelated data access.

Install only if you are comfortable sending your search terms to Perplexity and paying Perplexity API usage costs. Treat PERPLEXITY_API_KEY as a secret, avoid searching for confidential or regulated data unless your policy allows it, and be aware that formatted results may print remote URLs directly to your terminal.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/search.py:121

Finding

Unsanitized API-Controlled URLs Can Inject Terminal Control Characters

Content

View full analysis

Vulnerability Details

File Location: scripts/search.py:22-26 and scripts/search.py:121-124
Vulnerability Type: Incomplete output sanitization / terminal output injection
Risk Level: Low

The formatted output path sanitizes titles but prints API-provided URLs directly to the terminal.

python

def sanitize_output(text: str) -> str:
    """Strip ANSI control codes and other potentially dangerous characters"""
    # Remove ANSI escape sequences
    ansi_escape = re.compile(r'\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])')
    return ansi_escape.sub('', text)

python

for i, result in enumerate(results["results"], 1):
    title = sanitize_output(result.get('title', 'No title'))
    url = result.get('url', 'N/A')
    print(f"{i}. {title}")
    print(f"   URL: {url}")

Technical Analysis

Search-result fields originate from a remote API and ultimately from potentially attacker-controlled web content. The title and snippet fields pass through sanitize_output(), but the url field is printed without any sanitization or scheme validation.

A URL containing terminal control characters could manipulate terminal presentation, overwrite displayed lines, or spoof adjacent output. Furthermore, sanitize_output() only removes recognized ANSI escape sequences; it does not comprehensively remove unsafe C0/C1 control characters such as carriage return, backspace, or other display-affecting characters. This makes the documentation's broad claim that output sanitization prevents terminal injection inaccurate.

Attack Path

1. An attacker publishes or controls web content containing a crafted URL or metadata with terminal control characters.
2. The content is indexed and returned by the Perplexity Search API as a result.
3. The Skill decodes the API response without validating the result fields.
4. In formatted output mode, result.get('url', 'N/A') is assigned directly to url.
5. `print(f ...[truncated 631 chars]

Remediation

View remediation

Remediation Suggestions

1. Apply output sanitization to every untrusted formatted field, including URLs:

   python

   url = sanitize_output(str(result.get("url", "N/A")))
   

2. Strengthen sanitize_output() to remove unsafe C0 and C1 control characters while explicitly preserving only required whitespace:

   python

   def sanitize_output(value: object) -> str:
       text = str(value)
       text = ansi_escape.sub("", text)
       return "".join(
           char for char in text
           if char in "\t" or (ord(char) >= 0x20 and ord(char) != 0x7F)
       )
   

3. Validate result URLs with urllib.parse.urlparse and permit only expected schemes such as http and https. Reject or visibly label malformed and unsupported URLs.

4. Add regression tests covering ANSI escape sequences, carriage returns, line feeds, backspaces, null bytes, DEL, C1 controls, and unexpected non-string API values.

5. Update SKILL.md, README.md, and SECURITY_AUDIT.md so their security claims accurately describe the sanitizer's scope instead of asserting complete prevention of terminal injection.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (10)

Tainted flow: 'req' from os.environ.get (line 65, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/search.py (reported line 74)May include surrounding context.

python

try:
        # Add 30 second timeout
        with urlopen(req, timeout=30) as response:
            return json.loads(response.read().decode('utf-8'))
    except HTTPError as e:
        # Sanitize error body before exposing

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · PUBLISHING.md (reported line 26)May include surrounding context.

Option 1: Publish to ClawHub (Recommended)

Step 1: Create GitHub Repo (if not exists)

bash

cd /Users/craigmilligan/.openclaw/workspace/perplexity-search-skill

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · PUBLISHING.md (reported line 86)May include surrounding context.

When you make changes:

1. Update skill.json version (semantic versioning)
2. Add entry to CHANGELOG.md
3. Commit and tag:

   bash

   git add .
   

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README states the agent will 'automatically use this skill when searching the web' without defining narrow trigger conditions, approval requirements, or safety boundaries. In an agentic system, broad auto-invocation language can cause the skill to be used on loosely related prompts, increasing unintended external data sharing and expanding the attack surface for prompt-driven tool misuse.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares capabilities that use environment variables and outbound network access, but it does not explicitly scope or document those permissions. This weakens least-privilege guarantees and can mislead users or the platform about what the skill is allowed to access, increasing the risk of unexpected data access or exfiltration if the skill is modified or abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill sends user-provided search queries to Perplexity's third-party Search API, but the description does not clearly warn users that their queries leave the local environment. This creates a privacy and data-handling risk because users may submit sensitive internal terms, research topics, or personal data without understanding that the content is transmitted externally.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.py (reported line 50)May include surrounding context.

python

)
    
    # Build request
    url = "https://api.perplexity.ai/search"
    headers = {
        "Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill sends user-supplied search queries to Perplexity's external API, but the user-facing output and CLI flow do not clearly warn that entered queries leave the local environment. This can cause unintentional disclosure of sensitive prompts, internal names, or proprietary research terms if users assume the tool is purely local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file instructs users to place an API key into ~/.openclaw/openclaw.json, which affects sensitive credential storage. Although the file notes that users must provide their own key, it does not warn users to protect the config file, avoid committing it, or treat the key as secret.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 102)May include surrounding context.

}

text

2. **Permissions:** No elevated permissions required

3. **Rate Limiting:** Monitor usage at https://perplexity.ai/account/api

Static analysis

No suspicious patterns detected.