Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Perplexity web-search skill that sends user search queries to Perplexity using a user-provided API key, with no evidence of hidden persistence, local file access, or unrelated behavior.
Install this only if you are comfortable with web-search prompts being sent to Perplexity and with usage being billed to your Perplexity API key. Avoid using it for prompts containing secrets or private local data unless you intentionally want that text included in the external search request.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Set your Perplexity API key in the environment before starting OpenClaw:
# Add to ~/.openclaw/.env
PERPLEXITY_API_KEY=pplx-your-key-here
The README states the skill is auto-invoked on web-search intent with no visible narrowing criteria, which can cause the agent to send user prompts to an external service more often than users expect. Overly broad invocation increases the chance of transmitting sensitive or irrelevant prompt content to a third party and can create unintended tool use.
Claiming activation for 'anything web-related' is excessively broad and ambiguous, encouraging a tool-routing policy that may trigger on many ordinary prompts. In practice, this can expand external data sharing beyond user intent and increase privacy, compliance, and prompt-injection exposure through unnecessary browsing.
The skill declares capabilities requiring environment-variable access and network egress, but does not explicitly scope or declare permissions. That omission increases the chance of unintended execution or overbroad access because reviewers and runtime policy engines cannot easily enforce least privilege from the manifest alone.
The trigger phrases are broad everyday terms like 'current', 'recent', and 'find out', which can cause the skill to auto-invoke in contexts where the user did not intend a web search. Because this skill performs network access and consumes an API-backed credential, accidental invocation can leak user queries externally and incur unnecessary cost.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# ── Constants ──────────────────────────────────────────────────────────────────
API_URL = "https://api.perplexity.ai/chat/completions"
DEFAULT_MODEL = "sonar"
ALLOWED_MODELS = {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# ── Constants ──────────────────────────────────────────────────────────────────
API_URL = "https://api.perplexity.ai/chat/completions"
DEFAULT_MODEL = "sonar"
ALLOWED_MODELS = {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# ── Constants ──────────────────────────────────────────────────────────────────
API_URL = "https://api.perplexity.ai/chat/completions"
DEFAULT_MODEL = "sonar"
ALLOWED_MODELS = {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# ── Constants ──────────────────────────────────────────────────────────────────
API_URL = "https://api.perplexity.ai/chat/completions"
DEFAULT_MODEL = "sonar"
ALLOWED_MODELS = {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# ── Constants ──────────────────────────────────────────────────────────────────
API_URL = "https://api.perplexity.ai/chat/completions"
DEFAULT_MODEL = "sonar"
ALLOWED_MODELS = {
No suspicious patterns detected.