parallel-web
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the "parallel-web-tools[cli]" package version 0.7.1 via the uv tool environment. This is a vendor-owned resource from the skill author, used for the skill's primary functions.\n- [COMMAND_EXECUTION]: The skill utilizes "parallel-cli" for web searching, content extraction, and data enrichment. It mandates the use of stdin or quoted arguments for user input to prevent shell command injection.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external web content and explicitly instructs the agent to treat all such data as untrusted. It directs the agent to ignore any instructions found within search results or web pages.\n
- Ingestion points: Search results, web extracts, research reports, and monitor events are all ingested into the agent context.\n
- Boundary markers: The instructions include a strict requirement to treat all web content as untrusted data.\n
- Capability inventory: The skill uses "parallel-cli" (subprocess calls) and includes options for file output.\n
- Sanitization: The instructions emphasize the use of JSON serialization and stdin for handling external data.
Audit Metadata