Parallel Search

Security checks across malware telemetry and agentic risk

Overview

Parallel Search appears to be a straightforward web-search helper, with the main caveat that it relies on an already-authenticated Parallel CLI and can optionally pass saved results to a sub-agent.

Before installing, make sure `parallel-cli` comes from official Parallel sources and is authenticated to an account you are comfortable using for searches. Treat search queries as data sent to an external provider, avoid including secrets, and use the optional sub-agent summarization workflow only for search outputs you are comfortable sharing across agent sessions.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI04: Agentic Supply Chain Vulnerabilities
Low
What this means

The agent may use whatever `parallel-cli` is already installed on the machine; if that CLI is missing, outdated, or installed from an untrusted source, search behavior could be affected.

Why it was flagged

The skill depends on an external CLI that is not installed or reviewed as part of the provided artifacts. This is purpose-aligned, but users must trust and manage that CLI separately.

Skill content
Requires `parallel-cli` (installed and authenticated).
Recommendation

Install or update `parallel-cli` only from official Parallel documentation, verify the command before use, and stop if authentication or version checks fail.

#
ASI03: Identity and Privilege Abuse
Low
What this means

Search requests may be associated with the user's authenticated Parallel account, including any billing, logging, or policy controls applied by that service.

Why it was flagged

The skill expects the CLI to be authenticated, meaning searches may run under the user's Parallel account or API credentials. This is expected for the service, but it is not declared in the registry metadata as a primary credential.

Skill content
If `parallel-cli --version` fails, or if a later command fails with an authentication error, tell the user to see https://docs.parallel.ai/integrations/cli and stop.
Recommendation

Use an appropriate Parallel account or API credential, avoid submitting secrets in search queries, and review Parallel's data handling policies if query privacy matters.

#
ASI07: Insecure Inter-Agent Communication
Low
What this means

Search results, and possibly query-derived context, may be read by another agent session during summarization.

Why it was flagged

The optional long-context workflow passes saved search results to a spawned sub-agent. The task is scoped to a temporary search-results file, but the artifact does not detail sub-agent permission boundaries.

Skill content
"tool": "sessions_spawn", "task": "Read /tmp/search-<topic>.json and synthesize a summary with sources."
Recommendation

Use the sub-agent workflow only for non-sensitive search outputs, avoid secrets in queries or saved files, and ensure spawned agents have limited tool access where possible.