Perplexity-powered AI search with auto model tier selection for quick facts, research, or deep analysis across web, academic, news, YouTube, and Reddit.

Before installing or running this skill: - Expect to supply a Perplexity API key (PERPLEXITY_API_KEY or PPLX_API_KEY); the registry metadata should state this but currently does not — ask the publisher to correct the manifest. - Review the bundled script locally. It will try to read ~/.openclaw/openclaw.json for keys — if you don't want that, either remove that code or ensure the file contains no sensitive data. - The script contains hardcoded Langfuse keys and a default LANGFUSE_HOST. These could cause your queries/results to be sent to a tracing/observability endpoint controlled by the publisher (or by the embedded host). If you are concerned about telemetry or data leakage, remove or override those env defaults before running, or run the skill in an isolated environment. - Ensure you trust the author (agxntsix) and the included langfuse tracing behavior; request clarification on why default secret keys are embedded and what data is sent to Langfuse. - Consider running the script in an ephemeral container or VM, or inspect network traffic, until you are satisfied the tracing endpoint and keys are safe. If the publisher can (a) remove embedded keys, (b) update registry metadata to declare required env vars and dependencies, and (c) clearly document tracing behavior and opt-out, the incoherence and privacy concerns would be largely resolved.

Type: OpenClaw Skill Name: deep-search Version: 1.0.0 The skill bundle appears benign. The `SKILL.md` instructions are clear and do not contain any prompt injection attempts. The `deep_search.py` script performs web searches using the legitimate Perplexity API and includes optional Langfuse tracing to an internal host (`http://langfuse-web:3000`), which is an observability feature, not data exfiltration to an external malicious entity. The script attempts to retrieve the `PERPLEXITY_API_KEY` from environment variables or a specific path within `~/.openclaw/openclaw.json`, which is a common and likely intended mechanism for OpenClaw skills to access API keys for their operation, not an attempt to steal arbitrary secrets.