Trust Assessment
parallel-agents received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, User-controlled input directly passed as prompt to spawned AI agents.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | User-controlled input directly passed as prompt to spawned AI agents The `ai_orchestrator.py` skill defines `AgentTask` objects, which include a `task_description` field intended for user input. This `task_description` is then directly passed as the `task` argument to `tools.sessions_spawn` (via helper functions like `spawn_with_model_hierarchy` in `helpers.py`). This design allows an attacker to inject malicious instructions into the prompts of the spawned AI agents, potentially manipulating their behavior to perform unintended actions, generate harmful content, or misuse resources. Implement robust input sanitization, validation, and/or a safety layer (e.g., a separate LLM-based prompt guard) for the `task_description` before it is passed to `sessions_spawn`. Consider using a fixed template for the child agent's prompt where user input is strictly confined to data fields, rather than being part of the instruction set. | LLM | ai_orchestrator.py:59 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/jdalbright/parallel-agents/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/2bffc480a1065758)
Powered by SkillShield