parallel-cli-setup
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the Parallel CLI from external registries, including Homebrew (parallel-web/tap/parallel-cli), PyPI (parallel-web-tools[cli]), and NPM (parallel-web-cli). These resources are associated with the vendor 'parallel-web'.
- [COMMAND_EXECUTION]: The skill uses various bash commands for tool installation and account management. The platform configuration allows for the use of the
rmcommand, which is not required by the instructions, representing a broader-than-necessary permission set. - [INDIRECT_PROMPT_INJECTION]: The skill parses output from external commands, which could theoretically contain instructions intended to influence the agent's behavior.
- Ingestion points: The agent ingests JSON formatted data from
parallel-cli auth,parallel-cli login, andparallel-cli balancecommands (SKILL.md). - Boundary markers: Absent. The instructions do not provide delimiters or specific directives to isolate tool output from the agent's core instruction set.
- Capability inventory: The agent has access to multiple package managers and a range of shell commands through the
Bashtool. - Sanitization: Absent. There is no validation or filtering of the CLI output before it is processed by the agent.
- [DYNAMIC_EXECUTION]: The skill uses the
parallel-cli skills installcommand to download and register additional agent capabilities at runtime, extending the agent's functional footprint.
Audit Metadata