Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Parallel Search

v1.0.0

AI-powered web search via Parallel API. Returns ranked results with LLM-optimized excerpts. Use for up-to-date research, fact-checking, and domain-scoped searching.

0· 1.8k·7 current·7 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The SKILL.md describes a Parallel.ai search CLI and usage that matches the skill name and description. However, the registry metadata declares no required environment variables or primary credential while the instructions explicitly require a PARALLEL_API_KEY — an inconsistency that should be resolved.
!
Instruction Scope
Instructions direct the agent/operator to run the parallel-cli and to install it by executing a remote installer (curl https://parallel.ai/install.sh | bash). They also recommend writing results to /tmp and spawning a sub-agent to read those files. The file I/O and sub-agent behavior are reasonable for search results, but the explicit instruction to execute a remote installer and to export an API key broadens the runtime scope beyond just invoking a remote API.
!
Install Mechanism
No install spec in the registry, but SKILL.md recommends piping a remote install script from https://parallel.ai/install.sh into bash (curl | bash). Download-and-execute from a network host is high-risk because arbitrary code will run locally. The URL is a top-level domain matching the service homepage (parallel.ai), which is expected, but the install method still presents a substantial execution risk and should be reviewed before use.
!
Credentials
Registry metadata lists no required env vars, yet the SKILL.md instructs users to set PARALLEL_API_KEY=your-key. Requesting a single service API key is proportionate to a search integration, but the mismatch between declared requirements and the instructions is an incoherence that prevents automated permission review and is a practical risk (credential handling expectations unclear).
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and has no declared persistent system privileges. Autonomous invocation is allowed by default (disable-model-invocation:false), which is normal; this combined with the other concerns increases blast radius but does not by itself indicate excessive privilege.
What to consider before installing
This skill appears to be what it claims (a Parallel.ai search helper) but has two small red flags you should consider before installing: (1) SKILL.md tells you to run a remote install script with curl | bash — avoid blindly piping unknown installers into a shell; instead fetch the script, inspect it, or install via a trusted package source. (2) The registry metadata did not declare the required PARALLEL_API_KEY even though the docs ask you to set it — confirm where/how the key will be stored and that the skill will only use it for the Parallel API. If you plan to use this skill: verify the installer contents from https://parallel.ai, obtain an API key from the official site, prefer running the installer in an isolated environment (VM/container) first, and avoid giving this skill access to unrelated credentials or sensitive hosts.

Like a lobster shell, security has layers — review code before you run it.

latestvk97f28yy5j2s1ky9tr6wgez5dh80egbk
1.8kdownloads
0stars
1versions
Updated 10h ago
v1.0.0
MIT-0

Parallel Search

High-accuracy web search built for AI agents. Returns ranked results with intelligent excerpts optimized for LLM consumption.

When to Use

Trigger this skill when the user asks for:

  • "search the web", "web search", "look up", "find online"
  • "current news about...", "latest updates on..."
  • "research [topic]", "what's happening with..."
  • Fact-checking with citations needed
  • Domain-specific searches (e.g., "search GitHub for...", "find on Reddit...")

Quick Start

parallel-cli search "your query" --json --max-results 5

CLI Reference

Basic Usage

parallel-cli search "<objective>" [options]

Common Flags

FlagDescription
-q, --query "<keyword>"Add keyword filter (repeatable, 3-8 recommended)
--max-results NNumber of results (1-20, default: 10)
--jsonOutput as JSON
--after-date YYYY-MM-DDFilter for recent content
--include-domains domain.comLimit to specific domains (repeatable, max 10)
--exclude-domains domain.comExclude domains (repeatable, max 10)
--excerpt-max-chars-total NLimit total excerpt size (default: 8000)

Examples

Basic search:

parallel-cli search "When was the United Nations founded?" --json --max-results 5

With keyword filters:

parallel-cli search "Latest developments in quantum computing" \
  -q "quantum" -q "computing" -q "2026" \
  --json --max-results 10

Domain-scoped search:

parallel-cli search "React hooks best practices" \
  --include-domains react.dev --include-domains github.com \
  --json --max-results 5

Recent news only:

parallel-cli search "AI regulation news" \
  --after-date 2026-01-01 \
  --json --max-results 10

Best-Practice Prompting

Objective

Write 1-3 sentences describing:

  • The real task context (why you need the info)
  • Freshness constraints ("prefer 2026+", "latest docs")
  • Preferred sources ("official docs", "news sites")

Keyword Queries

Add 3-8 keyword queries including:

  • Specific terms, version numbers, error strings
  • Common synonyms
  • Date terms if relevant ("2026", "Jan 2026")

Response Format

Returns structured JSON with:

  • search_id — unique identifier
  • results[] — array of results:
    • url — source URL
    • title — page title
    • excerpts[] — relevant text excerpts
    • publish_date — when available

Output Handling

When turning results into a user-facing answer:

  • Prefer official/primary sources when possible
  • Quote or paraphrase only the relevant extracted text
  • Include URL + publish_date for transparency
  • If results disagree, present both and note the discrepancy

Running Out of Context?

For long conversations, save results and use sessions_spawn:

parallel-cli search "<query>" --json -o /tmp/search-<topic>.json

Then spawn a sub-agent:

{
  "tool": "sessions_spawn",
  "task": "Read /tmp/search-<topic>.json and synthesize a summary with sources.",
  "label": "search-summary"
}

Error Handling

Exit CodeMeaning
0Success
1Unexpected error (network, parse)
2Invalid arguments
3API error (non-2xx)

Prerequisites

  1. Get an API key at parallel.ai
  2. Install the CLI:
curl -fsSL https://parallel.ai/install.sh | bash
export PARALLEL_API_KEY=your-key

References

Comments

Loading comments...