research-lookup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). This set of URLs includes a direct curl|bash installer (https://parallel.ai/install.sh) which is a high-risk pattern — piping a shell script from an external/unvetted domain can deliver arbitrary/malicious code.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Skill runtime path lookup.py → research_lookup.py (ResearchLookup.lookup → _perplexity_lookup / _parallel_lookup) takes outsider-provided free-text query and sends it to Perplexity/Parallel, which returns search results/snippets that are then embedded in the LLM response and formatted for output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs runtime execution of a remote installer via "curl -fsSL https://parallel.ai/install.sh | bash", which fetches and executes remote code and is presented as a required step for the primary backend.