Trust Assessment
parallel-search received a trust score of 73/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 0 critical, 2 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via `parallel-cli` arguments, Unsafe `curl | bash` installation method.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via `parallel-cli` arguments The skill defines a `parallel-cli` tool that takes user-provided strings (e.g., `<objective>`, `<keyword>`) as arguments for shell execution. If the LLM directly interpolates untrusted user input into these arguments without proper shell escaping or sanitization, a malicious user could inject arbitrary shell commands. The skill implicitly instructs the LLM to construct and execute these commands based on user input. Implement robust input sanitization and shell escaping for all arguments passed to `parallel-cli`. Consider using a safer execution method than direct shell command construction, or ensure the LLM is explicitly instructed on how to escape user input for shell execution. | LLM | SKILL.md:20 | |
| HIGH | Unsafe `curl | bash` installation method The skill's prerequisites instruct users to install the `parallel-cli` using `curl -fsSL https://parallel.ai/install.sh | bash`. This method executes arbitrary code downloaded from a remote server directly into the user's shell, bypassing package managers and security review. This poses a significant supply chain risk, as a compromise of `parallel.ai`'s server or the `install.sh` script could lead to arbitrary code execution on the user's system. Recommend installing the CLI via a trusted package manager (e.g., `apt`, `yum`, `brew`, `pip`) or by downloading and verifying a signed binary. If `curl | bash` is the only option, advise users to review the script content before execution. | LLM | SKILL.md:99 |
Scan History
Embed Code
[](https://skillshield.io/report/a03aaf3e4c4fde40)
Powered by SkillShield