ClawHub
Back to skill

Security audit

Perplexity Wrapped Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Perplexity web-search helper that sends user queries to Perplexity and does not show hidden persistence, local file access, or unrelated data collection.

Install only if you are comfortable sending your search terms, prompts, and any --instructions content to Perplexity and potentially third-party models in agentic mode. Avoid pasting secrets or confidential internal data into queries, and use --json only when raw unwrapped API output is needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Ae1

High
Category
analysis-evasion
Content
- Split `config.mjs` from `search.mjs` for security scanner compatibility
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill documents network access and environment-based secret use (`PERPLEXITY_API_KEY`) but does not declare any tool scope such as `permissions` or `allowed-tools`. That creates a policy/visibility gap: callers and reviewers cannot reliably constrain or audit what capabilities the skill needs, increasing the risk of unintended network use or secret exposure in broader agent environments.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill's stated purpose is web search through Perplexity, but the documentation also advertises 1Password CLI integration for secret resolution. Adding an extra secret-management dependency broadens the capability surface beyond the core function, which can expose additional credentials or enable unintended secret access paths in agent environments.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script transmits user-supplied queries and optional agentic instructions to Perplexity endpoints, including a third-party-model/tooling mode, but provides no clear user-facing consent or privacy warning except for the separate deep-research cost prompt. This can expose sensitive prompts, internal data, or operational instructions to an external service without the user fully realizing that their input leaves the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
// ============================================================================

async function searchAPI(queries) {
  const response = await fetch("https://api.perplexity.ai/search", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${apiKey}`,
Confidence
88% confidence
Finding
This function sends search queries directly to an external API over the network. In a security-sensitive agent ecosystem, outbound transmission of user-provided content is itself a data-exposure risk when there is no explicit consent, minimization, or filtering of potentially sensitive input.

External Transmission

Medium
Category
Data Exfiltration
Content
// ============================================================================

async function searchAPI(queries) {
  const response = await fetch("https://api.perplexity.ai/search", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${apiKey}`,
Confidence
88% confidence
Finding
This function sends search queries directly to an external API over the network. In a security-sensitive agent ecosystem, outbound transmission of user-provided content is itself a data-exposure risk when there is no explicit consent, minimization, or filtering of potentially sensitive input.

External Transmission

Medium
Category
Data Exfiltration
Content
}

async function sonarAPI(query, model) {
  const response = await fetch("https://api.perplexity.ai/chat/completions", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${apiKey}`,
Confidence
89% confidence
Finding
The Sonar mode posts the user query to Perplexity's chat completions endpoint, creating an external data-sharing path. Although expected for a web-search skill, it still risks leaking confidential prompts or internal context if users are not clearly informed that content is transmitted off-box.

External Transmission

Medium
Category
Data Exfiltration
Content
}

async function sonarAPI(query, model) {
  const response = await fetch("https://api.perplexity.ai/chat/completions", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${apiKey}`,
Confidence
89% confidence
Finding
The Sonar mode posts the user query to Perplexity's chat completions endpoint, creating an external data-sharing path. Although expected for a web-search skill, it still risks leaking confidential prompts or internal context if users are not clearly informed that content is transmitted off-box.

External Transmission

Medium
Category
Data Exfiltration
Content
}

  // Agentic Research API uses OpenAI Responses-style endpoint at /v2/responses
  const response = await fetch("https://api.perplexity.ai/v2/responses", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${apiKey}`,
Confidence
95% confidence
Finding
Agentic mode sends both the query and optional system instructions to Perplexity's /v2/responses endpoint, and the feature description indicates third-party models with tools may be involved. This is more dangerous than plain search because it can disclose not just user queries but higher-value operational instructions and potentially route data into broader external processing chains.

External Transmission

Medium
Category
Data Exfiltration
Content
}

  // Agentic Research API uses OpenAI Responses-style endpoint at /v2/responses
  const response = await fetch("https://api.perplexity.ai/v2/responses", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${apiKey}`,
Confidence
95% confidence
Finding
Agentic mode sends both the query and optional system instructions to Perplexity's /v2/responses endpoint, and the feature description indicates third-party models with tools may be involved. This is more dangerous than plain search because it can disclose not just user queries but higher-value operational instructions and potentially route data into broader external processing chains.

Intent-Code Divergence

Low
Confidence
75% confidence
Finding
The security section states broadly that all non-JSON outputs are wrapped in untrusted-content boundaries. Elsewhere, the document also presents multiple output formats and operational modes, but does not reconcile whether all variants, including batch search and agentic outputs, are consistently wrapped the same way. This is a documentation-level overclaim about security behavior rather than a code-backed contradiction visible in this file.

Static analysis

No suspicious patterns detected.