Perplexity AI Search - security-hardened version (bash-based)

Use Perplexity API for web-grounded AI search. Use when user needs up-to-date information with source citations, factual queries about current events, or research-style answers. Default when user mentions Perplexity or needs current information with references.

This package is functionally consistent with a Perplexity API client and shows attention to common shell security issues, but pay attention to three things before installing/using it: 1) Metadata mismatch: the registry claims no required env vars or binaries, but the script needs an API key (PERPLEXITY_API_KEY or config.json) and requires bash, curl, and python3. Treat the API key as sensitive and do not provide it without confirming where the platform will store/use it. 2) Temporary auth file: the script writes the Authorization header to a temp file (mode 600) and deletes it; this reduces exposure but is not risk-free (race conditions, leftover files if the process is killed in unusual ways). If you are highly sensitive, review the script and consider running it in a sandbox or modifying it to use a more secure secret mechanism your environment provides. 3) Verify origin and endpoint: source and homepage are unknown. Confirm the endpoint (https://api.perplexity.ai/chat/completions) and the included code align with the published API and trustworthiness of the package owner. If you do not trust the publisher, run the script in an isolated environment or prefer an officially supported integration. If you plan to install this skill: request the publisher update registry metadata to declare the required env var(s) and binaries, inspect the code yourself (or ask a colleague), and avoid supplying production API keys until you are confident in provenance.

Type: OpenClaw Skill Name: perplexity-safe Version: 1.0.1 The `scripts/perplexity_search.sh` script is well-hardened against command injection and API key exposure, validating inputs and securely handling credentials as claimed in `SKILL.md`. However, the `_claude/settings.local.json` file grants `WebFetch` permissions to `github.com`, `raw.githubusercontent.com`, and `api.github.com`. These permissions are not utilized by the provided script, which only interacts with `api.perplexity.ai`. This over-permissioning represents a vulnerability, as it grants capabilities beyond the skill's stated purpose, making the bundle suspicious.