Parallel Deep Research
v1.0.0Deep multi-source research via Parallel API. Use when user explicitly asks for thorough research, comprehensive analysis, or investigation of a topic. For quick lookups or news, use parallel-search instead.
⭐ 3· 3.7k·27 current·30 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's name and description (deep multi-source research via Parallel API) align with the instructions in SKILL.md. However, the registry metadata declares no required environment variables or credentials while the SKILL.md explicitly requires a PARALLEL_API_KEY. That metadata/manifest mismatch is an incoherence: a research skill that calls an external API should declare its primary credential in requires.env.
Instruction Scope
The runtime instructions tell the agent/user to set PARALLEL_API_KEY, install a CLI, run queries, save files under /tmp or user-specified paths, and spawn sub-sessions to read those files. Those actions are consistent with the stated purpose, but the instructions reference an environment variable and an installation step that are not declared in the skill metadata. No other unexpected file/system access is requested.
Install Mechanism
There is no formal install spec in the package metadata, but SKILL.md recommends running curl -fsSL https://parallel.ai/install.sh | bash. Piping a remote install script to shell is a high-risk pattern: it downloads and executes arbitrary code from the network. While the URL appears to be the vendor's domain, the skill should either declare an install spec or avoid instructing users/agents to run a shell install in-line.
Credentials
The only credential implied by the instructions is PARALLEL_API_KEY, which is appropriate for a third-party research API. However, the skill metadata declares no required env vars or primary credential — that omission is misleading and reduces transparency. The SKILL.md does not request unrelated credentials, so the requested secret would be proportional if properly declared.
Persistence & Privilege
The skill does not request 'always: true' and uses default agent invocation permissions. It does not attempt to modify other skills or global agent config in the instructions. Saving research outputs to files and using sessions_spawn is within scope for this kind of skill.
What to consider before installing
This skill appears to document a legitimate Parallel.ai research CLI, but the package metadata is incomplete and the README tells you to run a curl | bash installer. Before installing or giving this skill an API key: 1) Ask the publisher to declare PARALLEL_API_KEY (primaryEnv) in the registry metadata so the requirement is explicit. 2) Verify the installer URL (https://parallel.ai/install.sh) independently on the vendor website and prefer official release packages or package-manager installs over piping a script to shell. 3) Create a limited-scope API key for testing (do not reuse high-privilege keys). 4) Run installation in a sandbox or isolated environment first. 5) If you need stronger assurance, request an install spec and a verifiable checksum/signature for the installer or use the upstream docs (https://docs.parallel.ai) rather than the skill text. If you don't want the agent to install or run external code autonomously, avoid granting it the ability to run the install commands automatically.Like a lobster shell, security has layers — review code before you run it.
latestvk979kq337gaqy872wf9z0691n980ewxj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.