Perplexity Wrapped Search

• Analyzed: May 12, 2026, 3:33 AM
• Findings: 1
• Version: 2.1.2
• Hash: dbe55dc1561dcc969a7cd44f1c926db459bc61673ffc3e810a04acd0c91dc223
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed for AI-powered web search via the Perplexity API, which aligns with its stated purpose. It makes network calls exclusively to the legitimate Perplexity API endpoint and handles the API key via environment variables. Crucially, the `SKILL.md` documentation and `scripts/search.mjs` code include explicit and robust measures to prevent prompt injection from external content, such as untrusted content boundaries, character folding, and direct instructions to the OpenClaw agent to treat all returned content as untrusted data. There is no evidence of data exfiltration, malicious execution, persistence, or prompt injection attempts within the skill's own instructions or code.