parallel-run
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the 'claude-parallel-orchestrator' package from PyPI or GitHub, which is an external resource provided by the author (jpoutrin).
- [COMMAND_EXECUTION]: The skill delegates execution to the 'cpo' CLI tool and runs arbitrary shell commands defined in the 'validation' field of the 'manifest.json' configuration file.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the project manifest. 1. Ingestion points: 'manifest.json' file in the parallel directory, specifically within wave validation fields. 2. Boundary markers: None identified; command strings are executed directly. 3. Capability inventory: Arbitrary shell command execution and git worktree management. 4. Sanitization: None detected; the skill treats the manifest content as trusted executable instructions.
Audit Metadata