ClawHub
Back to skill

Security audit

Parallel

Security checks across malware telemetry and agentic risk

Overview

This is a real Parallel.ai research skill, but it includes an embedded fallback API key and under-disclosed features that can create remote monitors, use webhooks, and forward a BrowserUse credential.

Review before installing. Use your own PARALLEL_API_KEY and remove or verify the embedded fallback key in scripts/search.py. Do not set BROWSERUSE_API_KEY unless you intentionally want BrowserUse authenticated browsing, and assume queries, URLs, task inputs, monitor events, and webhook payloads may be sent to external services. Create monitors only if you are prepared to manage persistent remote account state.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises and demonstrates use of environment secrets, network access, and shell execution, but does not declare corresponding permissions or capability boundaries. This can lead to unsafe execution assumptions by the host agent and reduces the ability to apply least-privilege controls or informed consent before the skill runs.

Description-Behavior Mismatch

Medium
Confidence
76% confidence
Finding
The skill metadata presents this as a web search/research capability, but the file implements persistent monitor creation, event retrieval, and deletion against an external service. That scope expansion matters because users or calling agents may grant trust appropriate for research tooling without realizing the skill can create long-lived remote resources and alter account state.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The code accepts an arbitrary webhook URL and instructs the remote service to send monitor events there, enabling outbound data delivery to third-party endpoints. In the context of a research-branded skill, this is more dangerous because collected search/event content could be silently forwarded outside the expected trust boundary, potentially to attacker-controlled infrastructure.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The script contains a hardcoded fallback API key in source code, which is a credential exposure issue. Anyone with access to the repository or packaged skill can extract and misuse the key to consume the external service, incur charges, or access account-associated data; in an agent skill context this is especially risky because skills are often redistributed and run in shared environments.

Vague Triggers

Medium
Confidence
83% confidence
Finding
Using a trigger as broad as "research" can cause the skill to activate in many unrelated conversations, increasing the chance that networked search behavior runs when the user did not intend it. In an agent setting, over-broad activation can expose prompts, consume external API credits, and route sensitive queries to third-party services unexpectedly.

Vague Triggers

Medium
Confidence
76% confidence
Finding
The phrase "deep search" is ambiguous and may match requests that are not intended to invoke this specific external-search skill. Ambiguous triggers increase accidental activation risk, especially in multi-skill environments where invocation should be precise and scoped.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script sends user-supplied natural-language queries and receives result data from the external Parallel.ai API, but it gives no explicit user-facing notice that potentially sensitive research prompts and returned entity data are being transmitted to a third-party service. In an agent skill context, this matters more because upstream prompts may contain confidential internal tasking, customer data, or strategic research topics that the operator may not realize are leaving the local environment.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The delete command immediately removes a monitor based solely on the provided ID, with no confirmation prompt, dry-run mode, or contextual warning. In an agent setting, this increases the chance of accidental or prompt-induced destructive actions that alter or erase user monitoring configuration.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script transmits user-provided research queries, company names, and person names to a third-party API without any explicit notice, confirmation, or privacy guardrail. In an agent context, this can unintentionally send sensitive prompts, personal data, or proprietary research topics outside the local environment, making the issue a real data-exposure risk even though the transmission is core to the tool’s purpose.

Missing User Warnings

Medium
Confidence
77% confidence
Finding
The function sends the full user query/objective to Parallel's external API without any disclosure, warning, or consent mechanism in the code path. In a research/search skill, this data flow is expected, but it can still expose sensitive prompts, internal identifiers, or user-provided secrets to a third party if callers are unaware of the transmission.

External Transmission

Medium
Category
Data Exfiltration
Content
local processor="${2:-base}"
  
  # Submit
  local response=$(curl -s -X POST "$BASE_URL/tasks/runs" \
    -H "x-api-key: $API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"processor\": \"$processor\", \"input\": \"$input\"}")
Confidence
95% confidence
Finding
curl -s -X POST "$BASE_URL/tasks/runs" \ -H "x-api-key: $API_KEY" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
if browseruse_key:
        mcp_servers = [{
            "type": "url",
            "url": "https://api.browser-use.com/mcp",
            "name": "browseruse",
            "headers": {"Authorization": f"Bearer {browseruse_key}"}
        }]
Confidence
88% confidence
Finding
https://api.browser-use.com/

Env Variable Harvesting

High
Category
Data Exfiltration
Content
# Build MCP servers for authenticated browsing
    mcp_servers = None
    browseruse_key = args.browseruse_key or os.environ.get("BROWSERUSE_API_KEY")
    if browseruse_key:
        mcp_servers = [{
            "type": "url",
Confidence
91% confidence
Finding
os.environ.get("BROWSERUSE_API_KEY

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.