perplexity
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill follows security best practices by requiring the
PERPLEXITY_API_KEYto be provided as an environment variable instead of hardcoding any secrets in the source code. - [DATA_EXFILTRATION]: All network requests in
scripts/search.mjsare directed toapi.perplexity.ai. This is the official, well-known domain for the Perplexity service and no sensitive local data is sent to the endpoint. - [EXTERNAL_DOWNLOADS]: The skill does not perform any external package installations (npm/pip) or remote script executions. It uses standard Node.js functionality.
- [COMMAND_EXECUTION]: The script
scripts/search.mjsprocesses user-supplied query strings into an API request but does not pass this input into shell execution or other dangerous functions. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external search results. While this is a surface for indirect injection, the script only performs text formatting and lacks the capabilities (like file writing or code execution) required for such an attack to be successful.
Audit Metadata