parallel
Pass
Audited by Gen Agent Trust Hub on May 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to orchestrate parallel tasks and execute local helper scripts (e.g.,.claude/lib/action-report-lib.sh) for tracking progress and generating reports. This behavior is consistent with the skill's stated purpose as a developer productivity tool. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it takes user-provided task descriptions and interpolates them into the prompts for sub-agents without explicit sanitization.
- Ingestion points: User input provided via the
/parallelcommand or task-specific prompts inSKILL.mdexamples. - Boundary markers: None are defined to separate user input from agent instructions.
- Capability inventory: The skill has access to
Bashexecution, file modifications viaWrite/Edit, and the ability to spawn further sub-agents via theTasktool. - Sanitization: No sanitization or escaping of the user-provided task strings is performed before they are passed to the sub-agent context.
Audit Metadata