Parallel

High-accuracy web search and research via Parallel.ai API. Optimized for AI agents with rich excerpts and citations. Supports agentic mode for token-efficien...

This skill appears to implement a legitimate Parallel.ai client, but there are a few red flags to review before installing: - Inspect and remove the hard-coded API key in scripts/search.py. A hard-coded fallback means the skill may run using a credential you don't control; this can incur costs or leak usage to someone else. Replace it with strict failure when PARALLEL_API_KEY is missing or document an explicit demo key policy. - Be aware of optional env vars not declared in the registry (BROWSERUSE_API_KEY, PARALLEL_MAX_WAIT). If you provide BROWSERUSE_API_KEY, the skill will forward it to an external MCP endpoint (browser-use.com) for authenticated browsing — that enables access to gated pages but also means sensitive page contents or credentials may be shared with that third party. - Monitor webhooks and callbacks: monitor.create accepts a webhook URL that the Parallel service will call. Do not configure untrusted webhook URLs, since monitors may send content or alerts to those endpoints. - Verify the pip package 'parallel-web' and the upstream Parallel.ai service before supplying your API key. Check account usage/quotas after first use. - If you install: (1) remove or rotate any embedded keys, (2) run scripts in an isolated environment, and (3) prefer providing your own PARALLEL_API_KEY and avoid supplying optional third-party browsing keys or webhooks unless you trust those endpoints. Given these inconsistencies and the embedded key, I recommend manual code review and remediation before enabling this skill for production use.

Type: OpenClaw Skill Name: parallel Version: 1.2.1 The skill bundle provides a functional interface for the Parallel.ai API but contains a hardcoded API key in `scripts/search.py`, which is a significant security vulnerability and credential leak. Additionally, `scripts/task.py` includes support for authenticated web browsing via a third-party service (browser-use.com), a high-privilege capability that increases the potential impact of misuse, although it is documented as a feature for deep research.