Parallel Enrichment

AdvisoryAudited by Static analysis on May 7, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill may fail unless the Parallel CLI is already installed, and users need to ensure they are using the legitimate CLI.

Why it was flagged

The skill relies on an external CLI, while the registry metadata reports no install spec or required binaries. That makes CLI installation, version, and provenance outside the reviewed artifact.

Skill content
parallel-cli enrich run [options]
Recommendation

Install `parallel-cli` only from Parallel's official source and verify the command/version before using this skill.

What this means

Input CSV rows, inline records, and requested enrichment fields may leave the local environment and be processed by Parallel.

Why it was flagged

The workflow sends user-provided records and enrichment requests to the Parallel API, and the examples include lead/contact enrichment that may involve personal or sensitive business data.

Skill content
Bulk data enrichment via Parallel API. Adds web-sourced fields... "look up contact info for..."
Recommendation

Use this only with data you are allowed to share with Parallel, and check Parallel's privacy, retention, and compliance terms for regulated or confidential datasets.

What this means

Another agent/session may read and summarize the enriched CSV, which could expose sensitive rows or contact information in the conversation or logs.

Why it was flagged

For large enrichments, the skill suggests handing the enriched output file to a spawned sub-agent. This is bounded to summarization, but it expands access to the enriched data.

Skill content
"tool": "sessions_spawn", "task": "Read /tmp/enriched-<topic>.csv and summarize the results."
Recommendation

Only spawn a sub-agent for non-sensitive or approved datasets, avoid shared temporary paths for confidential outputs, and clean up temporary files after use.