ClawHub
Back to skill

Security audit

Parallel Search

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward web-search skill that uses Parallel's CLI/API, with privacy caveats typical of sending search queries to an external service.

Install only if you are comfortable using an authenticated Parallel CLI for searches. Treat query text as data sent to an external provider, avoid secrets or confidential material in searches, and use the optional saved-results/sub-agent workflow only for non-sensitive research output.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrases are broad enough to match many ordinary requests like 'look up' or 'find online', which can cause the agent to invoke this skill unexpectedly. Because the skill sends user queries to an external search API, over-broad routing increases the chance of unnecessary data disclosure and unintended tool use, especially in conversations containing sensitive or internal context.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill description does not warn that prompts and query terms will be transmitted to a third-party service via Parallel API. Users or calling agents may therefore pass sensitive, regulated, or proprietary information into the search query without realizing it leaves the local environment, creating privacy and compliance risk.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.