Parallel 1.0.1

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:51 AM UTC
• Version: 1.0.0

Overview

The skill is a real Parallel.ai research helper, but it embeds and silently uses a plaintext API key while sending user queries to a third-party service.

Review this skill before installing. The publisher should remove and revoke the embedded API key, require users to provide their own PARALLEL_API_KEY, narrow the triggers, disclose that queries are sent to Parallel.ai, and pin the Python dependency. Do not submit secrets, private prompts, or proprietary data through it unless you are comfortable sending that data to Parallel.ai.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/search.py:13

Finding

Hard-Coded Parallel.ai API Credential

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/parallel.sh:18

Finding

JSON Injection Through Unescaped Research Input

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:19

Finding

Unpinned Python Dependency Installation

Content

View full analysis

Remediation

View remediation

" ``` 2. Prefer a lock file or hash-verified requirements file: ```text parallel-web== \ --hash=sha256: ``` 3. Install with hash enforcement: ```bash pip install --require-hashes -r requirements.txt ``` 4. Pin and review transitive dependencies using an appropriate dependency-locking workflow. 5. Install dependencies in an isolated virtual environment using a non-privileged account. 6. Configure an approved package index explicitly and monitor dependencies for security advisories. 7. Review and test dependency upgrades before changing pinned versions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description promises a web search/research skill optimized for rich excerpts and citations, but the code is a general-purpose wrapper for Parallel.ai's task execution endpoint (/tasks/runs). It submits freeform prompts to a base processor and returns whatever output the task API provides. There is no explicit use of a search-specific API, no handling of search results, citations, or excerpt formatting, and no mechanism ensuring high-accuracy search behavior. The included company and person commands are consistent with broad research, but the primary implementation is generic task submission rather than a dedicated web-search integration. Additionally, the status command is an undeclared operational capability, and the hardcoded API key indicates access to an external service not reflected in the declared permissions. Overall, the declared description overstates and mischaracterizes the implemented behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script hardcodes a usable default API key and automatically uses it when no environment variable is set. This creates unauthorized authenticated access, enables silent use of a third-party account, and exposes the embedded credential to anyone who can read or copy the skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill advertises executable usage via Python and shell commands but does not declare any explicit tool scope such as allowed tools or permissions. In an agent environment, this can lead to over-broad execution authority or unclear enforcement boundaries, making it easier for the skill to invoke shell/environment capabilities beyond what users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The trigger phrase "deep search" is ambiguous and can match ordinary language rather than a deliberate request to use this specific skill. In agent systems, ambiguous triggers increase the chance of unintended external lookups or shell execution, though the risk is somewhat lower than the single-word trigger "research."

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase "research" is extremely broad and likely to match many unrelated user requests, causing accidental activation of this skill. Unintended invocation is risky because the skill can drive shell-based code paths and external API usage, potentially leaking queries, consuming paid resources, or bypassing more appropriate tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script uses credentials for outbound requests without warning the user whether they come from the environment or an embedded fallback. This is risky because users may unknowingly trigger authenticated external actions or consume another party's account resources.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/parallel.sh (reported line 8)May include surrounding context.

sh

set -e

API_KEY="${PARALLEL_API_KEY:-y2s_m4er5i6-5qCikOLUtmnkvOYRU24eDphq_jg1}"
BASE_URL="https://api.parallel.ai/v1"
MAX_WAIT="${PARALLEL_MAX_WAIT:-120}"

# Submit task and poll for result

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This code transmits user-controlled input to an external API endpoint over the network. While external transmission is core to the skill's research function, it is still security-relevant because agent users may pass sensitive or proprietary data that leaves the local trust boundary.

Content

Scanner excerpt · scripts/parallel.sh (reported line 17)May include surrounding context.

sh

local processor="${2:-base}"
  
  # Submit
  local response=$(curl -s -X POST "$BASE_URL/tasks/runs" \
    -H "x-api-key: $API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"processor\": \"$processor\", \"input\": \"$input\"}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User-supplied queries and research targets are sent directly to an external service, but the script provides no notice or consent mechanism before transmitting potentially sensitive input. In an agent setting, this increases the risk of inadvertent exfiltration of private prompts, names, or internal research topics.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sends the user's query directly to the external Parallel.ai service, but it does not provide any warning, consent prompt, or output disclosure that the query leaves the local environment. In an agent-skill context, queries may contain sensitive user data, internal prompts, or secrets, so silent transmission to a third party creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.