parallel-research

Pass

Audited by Gen Agent Trust Hub on Feb 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Communicates with the Parallel AI API (api.parallel.ai) to fetch research data and perform entity discovery. This is the primary intended function of the skill and targets a well-known service provider.
  • [DATA_EXFILTRATION]: Handles authentication using environment variables for the Parallel AI API and a local credentials file (mycreds.txt) for Google Drive integration. Research results are saved to the local .tmp/ directory and can be uploaded to Google Drive as requested by the user. These operations are functional and consistent with the skill's purpose.
  • [PROMPT_INJECTION]: The skill processes untrusted external data retrieved from the web via Parallel AI and scrapers, creating a surface for indirect prompt injection where malicious instructions embedded in web content could influence the agent's summary or report generation.
  • Ingestion points: API responses from api.parallel.ai and scraped content in vendor_selection.py.
  • Boundary markers: No explicit delimiters are used in the prompts to isolate external web content from the agent's primary instructions.
  • Capability inventory: The skill possesses file system access (.tmp/), network operations (requests), and cloud storage integration (pydrive2).
  • Sanitization: No explicit sanitization or filtering of retrieved web content is performed before it is included in markdown or PDF reports.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 24, 2026, 04:22 AM