Security audit

perplexity-toolkit

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly works as a Perplexity research automation tool, but it also includes under-disclosed browser-session control, bot-detection evasion language, and account-history deletion capability.

Install only if you are comfortable giving the tool control of a logged-in Perplexity browser session. Use a dedicated browser profile or account, review batch output paths, avoid unattended runs, and do not use the history delete command unless you have backed up or intentionally selected the conversations to remove. The anti-detection framing also means you should consider Perplexity's terms and account-risk tolerance before using it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises capabilities that imply environment access, file read/write, and network use, but it does not declare any permissions. This creates a transparency and review gap: operators may approve or run the skill without understanding its actual access scope, which increases the risk of unintended data exposure or unsafe execution in automation environments.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose focuses on search, extraction, aggregation, and verification, but the detected behavior includes account-history enumeration, title-based history search, and deletion of Perplexity conversations. That mismatch is dangerous because users may grant browser/account access expecting read-oriented research automation, while the skill can perform destructive actions against account data that were not clearly disclosed.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The document explicitly broadens the intended capability from search/research automation into browser-only actions that exceed the stated skill scope. That scope expansion is dangerous because it can normalize adding higher-risk features later, including persistent workspace access and logged-in UI manipulation, without clear user need or least-privilege boundaries.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The document identifies agentic browsing under a logged-in session, including acting on pages and form-like workflows, as a target capability. In a search toolkit context, this creates clear risk of unauthorized actions, exposure of session data, and privilege escalation from passive research into active account operations.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: Stating that the 'whole point' of the parent skill is broader logged-in web-only feature access reframes the skill from a research helper into a general-purpose account automation layer. That increases the chance of unsafe implementation choices, overcollection of user data, and eventual use beyond the declared manifest scope.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The CLI exposes a `history delete` capability that goes beyond the stated search/aggregate/verify purpose of the skill. In an agent context, hidden or extra destructive features materially increase risk because a caller expecting read-only search automation may unknowingly gain data-destruction functionality against the user's Perplexity account history.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: `delete_conversations(...)` provides direct destructive access to conversation history, which is not justified by a search toolkit's expected functionality. Even with `--dry-run` available, actual deletion can be triggered from the CLI without additional safety gates, enabling accidental or unauthorized loss of user data if the tool is invoked by another agent or workflow.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The module implements destructive deletion of user conversation history even though the skill is ներկայացված as a search/extract/aggregate/verify toolkit. This mismatch increases the risk that users or calling agents invoke data-destroying behavior they would not reasonably expect, enabling silent loss of chat history and weakening informed consent.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Bulk deletion is a powerful destructive capability that is not justified by the stated purpose of a Perplexity search automation toolkit. In an agent setting, this creates unnecessary blast radius: a bad prompt, integration mistake, or malicious instruction could wipe large portions of a user's history with little friction.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The docstring does more than describe input simulation: it explicitly emphasizes that CDP key dispatch produces trusted events that are 'invisible to Perplexity's bot detection.' That framing indicates deliberate anti-detection behavior, which can be used to bypass platform controls and conceal automation from abuse defenses; in a search automation skill, this materially increases misuse risk.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The helper intentionally uses low-level CDP input dispatch specifically because it follows the real keyboard path and avoids normal untrusted DOM-event indicators. That gives the skill a built-in capability to evade detection while submitting queries, which is unnecessary for basic extraction/aggregation and enables covert automated abuse at scale.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This module is explicitly designed to evade detection by simulating human behavior, including stealthy typing, mouse movement, scrolling, and timing patterns. In the context of a search/extract toolkit, anti-detection functionality meaningfully expands the tool from ordinary automation into evasive automation that could be used to bypass platform safeguards, bot detection, or acceptable-use controls.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The test suite explicitly validates an 'antidetect' module that introduces human-like, lognormal, micro, and distraction delays, which are common anti-bot evasion techniques rather than functionality needed for ordinary Perplexity search, extraction, or aggregation. In the context of an automation toolkit, preserving and regression-testing these behaviors suggests intentional support for stealthy automation that could help bypass rate limits or detection controls on third-party services.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly states it uses the user's existing logged-in Perplexity Pro session and provides automation steps to submit queries, read answer contents, and extract links from the page, but the description does not prominently warn the user that authenticated browser state and page contents will be used and scraped. This creates a real consent/transparency issue: users may invoke the skill without understanding that their account session, personalized results, and potentially sensitive page content visible in the authenticated session are being accessed programmatically.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs saving successful patterns as versioned YAML scripts under `scripts/perplexity/` but does not warn the user that this writes files into the repository. In an agent setting, undocumented persistence can lead to unreviewed file creation, repository pollution, or accidental retention of sensitive search workflows and prompts.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file promotes logged-in browser automation and agentic actions without adequately addressing privacy, consent, account safety, or system-impact controls. In practice, this omission can lead implementers to treat authenticated automation as low risk, even though it may expose session tokens, personal data, and perform unintended actions on behalf of a user.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document frames automating the consumer web UI as a practical route to unlock more features, but does not pair that recommendation with clear warnings about ToS, account restriction, consent, and abuse-detection risks. That omission is security-relevant because it encourages implementation of higher-risk automation in authenticated consumer environments without governance or safeguards.

Missing User Warnings

Low

Confidence: 96% confidence
Finding: The document explicitly instructs the agent to persist attacker-controlled content verbatim to `/tmp/perplexity-twitter-community-issues.md`, which is a file write action embedded in untrusted skill content. Even though the target is a temporary path, hidden write instructions in documentation can cause unauthorized filesystem modification, enable overwrite of expected outputs, and normalize following operational directives from analyzed content.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The delete command performs a destructive action with no explicit confirmation or warning in this file before calling `delete_conversations`. In automation scenarios, this makes unintended deletion much more likely, especially when commands are generated or passed through by other tools, and the skill context makes this more dangerous because users would reasonably expect search/history inspection, not silent destructive mutation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The bulk deletion path proceeds directly from selection to deletion without any explicit user confirmation or warning in this code path. Because the function can target many conversations by query or list, a caller can trigger irreversible deletion accidentally or abusively, especially in autonomous agent workflows.

Static analysis

No suspicious patterns detected.