Security Audit
parallel-agents
github.com/sickn33/antigravity-awesome-skillsTrust Assessment
parallel-agents received a trust score of 82/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Broad filesystem access granted to skill, Agent synthesis protocol can exfiltrate sensitive data from filesystem.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Agent synthesis protocol can exfiltrate sensitive data from filesystem The skill's 'Synthesis Protocol' describes how agents consolidate findings after analyzing code. Given the `Read`, `Glob`, and `Grep` permissions, agents can access and process sensitive information from files. If an agent is prompted to include specific findings in its synthesis, or if it inadvertently includes sensitive data (e.g., API keys, proprietary code snippets) found during its analysis, this information could be exfiltrated through the agent's output. The `SKILL.md` explicitly outlines how agents will read code and then synthesize findings, creating a credible path for data exfiltration. Implement robust output sanitization and content filtering for all agent outputs, especially during the synthesis phase, to prevent the inclusion of sensitive data. Ensure agents are explicitly instructed and constrained not to output raw sensitive file contents. Consider implementing data loss prevention (DLP) mechanisms. | LLM | SKILL.md:105 | |
| MEDIUM | Broad filesystem access granted to skill The skill declares `Read`, `Glob`, and `Grep` permissions, which grant broad access to the filesystem. While these permissions are likely necessary for a code analysis skill, they allow agents to read, list, and search the contents of any file within the accessible scope. This increases the attack surface for data exfiltration or unauthorized information disclosure if the agents are misused or compromised. Review if all three permissions (`Read`, `Glob`, `Grep`) are strictly necessary. Consider implementing more granular access controls or restricting file access to specific directories or file types if possible. Implement strict output filtering for agents to prevent sensitive data from being included in synthesis. | LLM | Manifest (frontmatter JSON) |
Scan History
Embed Code
[](https://skillshield.io/report/422f8ffc4a60f600)
Powered by SkillShield