Parallel Monitor

AdvisoryAudited by Static analysis on May 7, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If the CLI is already logged in, the agent can use that account to create, update, list, delete, and simulate Parallel monitors when following this skill.

Why it was flagged

The skill relies on an authenticated Parallel CLI session to manage monitors in the user's Parallel account, although the registry metadata declares no primary credential or required binary.

Skill content
Requires `parallel-cli` (installed and authenticated).
Recommendation

Confirm the Parallel CLI is authenticated to the intended account and workspace before using the skill, and consider declaring the CLI/auth requirement in metadata.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

A monitor may keep running and producing events until the user updates or deletes it.

Why it was flagged

The skill creates monitors that continue running on a schedule after initial setup. This persistence is the stated purpose and is disclosed, but it is important for users to notice.

Skill content
Recurring research that should re-run automatically without re-prompting
Recommendation

Only create monitors the user explicitly wants, record the monitor_id, and use the documented delete command when monitoring is no longer needed.

What this means

Monitor event data could be delivered to whatever webhook endpoint is configured.

Why it was flagged

The skill supports sending monitor events to an external webhook URL. This is optional and purpose-aligned, but monitor outputs and objectives may leave the Parallel environment.

Skill content
`--webhook <url>` | Webhook URL for event delivery
Recommendation

Use only trusted webhook URLs, avoid embedding secrets in URLs when possible, and make sure the user understands what data will be sent.

What this means

The behavior and security of the actual CLI depend on the user's installed parallel-cli package, which is outside this skill artifact.

Why it was flagged

The skill depends on an external CLI that is not installed or pinned by this artifact. The instruction tells the agent to stop rather than install arbitrary code, so this is a disclosure/provenance note rather than a concern.

Skill content
If `parallel-cli --version` fails, or if a later command fails with an authentication error, tell the user to see https://docs.parallel.ai/integrations/cli and stop.
Recommendation

Install or update parallel-cli only from official Parallel documentation and verify it before authenticating.