Parallel AI Skill

High-accuracy web search and research via Parallel.ai API. Optimized for AI agents with rich excerpts and citations.

Do not install or run this skill blindly. Before using it: 1) Treat the hard-coded API key as suspicious — do not rely on it; prefer to set your own PARALLEL_API_KEY and remove/replace any hard-coded defaults. 2) Verify provenance — the source and homepage are unknown. Ask the publisher for official docs or an official package. 3) Expect the scripts to call external APIs (api.parallel.ai, api.browser-use.com) and to allow sending data to webhooks you supply — never provide webhooks or browser-use credentials that accept arbitrary sensitive data. 4) Ensure required local tools (curl, jq, python dependencies) are present. 5) If you already ran these scripts with your credentials, consider rotating those API keys. 6) If you need this capability but want lower risk, request an official SDK/package from the Parallel.ai vendor or use a vetted connector rather than an unknown third-party bundle.

Type: OpenClaw Skill Name: parallel-ai Version: 1.0.1 The skill is classified as suspicious due to two significant vulnerabilities. The `scripts/parallel.sh` file contains a shell injection vulnerability where user input is directly embedded into a `curl -d` command without proper sanitization, potentially allowing arbitrary command execution. Additionally, `scripts/search.py` includes a hardcoded API key as a fallback value (`y2s_m4er5i6-5qCikOLUtmnkvOYRU24eDphq_jg1`), which is a critical security flaw exposing a secret. While these are serious flaws, they do not demonstrate intentional malicious design by the skill itself, but rather vulnerabilities that could be exploited.