Parallel AI search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:55 AM UTC
• Version: 1.0.3

Overview

The skill’s main purpose is coherent, but it tells agents to install a dependency by running an unverified internet script directly in the shell.

Review before installing. Prefer the `pipx install "parallel-web-tools[cli]"` path or independently verify any installer script before running it. Only use Parallel with data you are willing to send to that service, and configure monitor webhooks only to endpoints you control and trust.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58

Finding

Unverified Remote Installer Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:58
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

curl -fsSL https://parallel.ai/install.sh | bash

Technical Analysis

The installation instructions pipe content retrieved from a remotely controlled URL directly into bash. The effective executable payload is not included in the reviewed project and can change at any time after the Skill has been audited.

The command provides no version pinning, cryptographic signature validation, checksum verification, or opportunity to inspect the downloaded script before execution. HTTPS protects the connection in transit but does not guarantee that the server, publisher account, DNS configuration, or release infrastructure has not been compromised.

Installing parallel-cli supports the Skill's declared functionality, but immediate execution of a mutable remote script is not the minimum-risk method needed to install it. The same document provides a pipx alternative, demonstrating that direct remote shell execution is not functionally required. That alternative is also not version-pinned, but it does not use the same direct curl | bash execution channel.

Attack Path

1. An attacker compromises or gains control of parallel.ai/install.sh, its hosting infrastructure, publisher account, or an equivalent part of its delivery chain.
2. The attacker modifies the remote installer to include arbitrary shell commands.
3. An Agent or user follows the Skill instructions when parallel-cli is unavailable.
4. curl retrieves the attacker-controlled content and streams it directly to bash.
5. The malicious commands execute immediately with all privileges available to the invoking account.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking user's security context. The resulting scope may include reading or ...[truncated 440 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | bash installation command.
• Prefer installation from a trusted package registry using an explicitly pinned version, for example a reviewed version of parallel-web-tools[cli].
• If a shell installer must be supported, download a versioned artifact to a local file rather than streaming it into a shell.
• Verify the downloaded artifact using a publisher signature or a SHA-256 checksum obtained through a separately trusted channel.
• Allow the installer contents to be inspected before execution.
• Execute installation with the least-privileged account possible and do not request administrative privileges unless a documented installation step strictly requires them.
• Pin the pipx package version and establish a controlled upgrade process so future dependency changes receive separate review.

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/troubleshooting.md:9

Finding

Troubleshooting Guide Repeats Unverified Remote Shell Execution

Content

View full analysis

Vulnerability Details

File Location: references/troubleshooting.md:9
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

curl -fsSL https://parallel.ai/install.sh | bash

Technical Analysis

The troubleshooting guide repeats an installation command that retrieves a remotely mutable script and executes it immediately through bash. Because the downloaded payload is not pinned or present in the project, its behavior cannot be established by auditing this repository alone.

No checksum, signature, fixed release version, or local review step is required. A compromise of the remote distribution channel could therefore turn a routine troubleshooting action into arbitrary local code execution. The use of HTTPS does not mitigate compromise of the trusted endpoint or its deployment pipeline.

Direct remote shell execution is not necessary for the declared troubleshooting objective. A package-manager-based fallback is already documented and can be hardened through explicit version pinning and package provenance verification.

Attack Path

1. An attacker compromises the remote installer endpoint or its software delivery chain.
2. The attacker replaces the installer response with a script containing malicious commands.
3. A user experiencing a "parallel-cli not found" error copies the documented troubleshooting command.
4. The response is passed directly from curl into bash without validation.
5. The malicious payload executes with the permissions of the user running the command.

Impact Assessment

Exploitation can provide arbitrary code execution as the invoking user. Accessible data, configuration, authentication material, and API credentials may be exposed or modified. The payload could also install additional software or persistence mechanisms within the user's permission boundary.

Although the documented command does not itself elevat ...[truncated 179 chars]

Remediation

View remediation

Remediation Suggestions

• Delete the direct curl -fsSL ... | bash recommendation from the troubleshooting guide.
• Make a version-pinned package-manager installation the primary recovery procedure.
• If distributing an installer script remains necessary, reference an immutable release artifact and document separate download, signature or checksum verification, inspection, and execution steps.
• Publish trusted checksums and signing keys through a channel independent of the artifact host.
• Avoid administrative execution and document the exact files and directories the installer is expected to modify.
• Keep installation guidance consistent across SKILL.md and all reference documents to prevent users from falling back to the unsafe command.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Fetching a script from the internet and piping it directly to bash executes remote code without inspection, integrity verification, or version pinning. If the source, transport, DNS, or hosting account is compromised, the agent could run attacker-controlled commands with the current user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

If parallel-cli is missing, install it:

bash

curl -fsSL https://parallel.ai/install.sh | bash

If you cannot use the install script, use pipx:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The pipe into bash creates a dangerous command chain where untrusted network output is immediately interpreted as shell commands. In an agent workflow, this reduces opportunities for review and makes prompt-induced tool use much more likely to become arbitrary code execution.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

If parallel-cli is missing, install it:

bash

curl -fsSL https://parallel.ai/install.sh | bash

If you cannot use the install script, use pipx:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The troubleshooting guide recommends piping a remotely fetched script directly into bash, which executes unverified code from the network without giving the user an opportunity to inspect it. If the remote host, transport, or distribution path is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · references/troubleshooting.md (reported line 9)May include surrounding context.

• Install:

bash

curl -fsSL https://parallel.ai/install.sh | bash

Fallback install:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The use of a shell pipeline into bash is a classic command-chaining pattern that turns downloaded content directly into executable shell input. This removes integrity checks and review steps, so any malicious or unexpected response body becomes immediate code execution.

Content

Scanner excerpt · references/troubleshooting.md (reported line 9)May include surrounding context.

• Install:

bash

curl -fsSL https://parallel.ai/install.sh | bash

Fallback install:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to install a missing dependency using a remote shell script but does not include any warning or verification step. In an agent context, this can normalize unsafe bootstrap behavior and lead to execution of unreviewed code from the network, increasing supply-chain risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The monitor feature documents webhook delivery to arbitrary URLs without warning that monitored data will be transmitted to an external endpoint. In practice, this could cause unintended exfiltration of user prompts, monitored content, or derived results to third-party infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The monitor webhook example sends collected monitoring events to an external URL but provides no warning that potentially sensitive search objectives, discovered URLs, or event data may leave the local environment. In a skill specifically designed for live web search and monitoring, users may copy/paste this command into real workflows and unintentionally exfiltrate data to third-party endpoints they do not control or have not vetted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.