ClawHub
Back to skill

Security audit

open-perplexity

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently opens Perplexity in Brave and does not show hidden persistence, credential access, exfiltration, or destructive behavior.

Reasonable to install if you want a Brave shortcut to Perplexity. Review or remove the broad "open ai search" trigger if you use multiple AI-search skills, and consider changing the Windows opener to avoid shell=True as a hardening improvement.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
system = platform.system()

if system == "Windows":
    subprocess.Popen(["start", "brave", url], shell=True)
elif system == "Darwin":
    subprocess.Popen(["open", "-a", "Brave Browser", url])
else:
Confidence
95% confidence
Finding
The Windows branch launches a subprocess with shell=True, which is inherently riskier because command resolution is delegated to the shell. Although the URL is hardcoded and there is no direct user input here, using shell invocation expands the attack surface and can enable unexpected command execution behavior if arguments or environment assumptions change.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger phrase "open ai search" is generic and could unintentionally invoke this skill when a user meant a different AI tool or a broader search action. Ambiguous invocation increases the chance of accidental activation and action-routing mistakes, especially in voice-driven or multi-skill environments where similar phrases may map to different behaviors.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
system = platform.system()

if system == "Windows":
    subprocess.Popen(["start", "brave", url], shell=True)
elif system == "Darwin":
    subprocess.Popen(["open", "-a", "Brave Browser", url])
else:
Confidence
97% confidence
Finding
This is effectively the same underlying issue as the other TM1 finding: using Popen with shell=True introduces unnecessary shell interpretation and weakens safety guarantees around command execution. In the context of a skill whose purpose is simply to open a known website, invoking a shell is more dangerous than needed.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
system = platform.system()

if system == "Windows":
    subprocess.Popen(["start", "brave", url], shell=True)
elif system == "Darwin":
    subprocess.Popen(["open", "-a", "Brave Browser", url])
else:
Confidence
97% confidence
Finding
This is effectively the same underlying issue as the other TM1 finding: using Popen with shell=True introduces unnecessary shell interpretation and weakens safety guarantees around command execution. In the context of a skill whose purpose is simply to open a known website, invoking a shell is more dangerous than needed.

Static analysis

No suspicious patterns detected.