parallel-data-enrichment

Fail

Audited by Socket on Mar 3, 2026

1 alert found:

Malware
MalwareHIGH
SKILL.md

Functionally, the module/skill is consistent: it automates uploading user data to Parallel.ai via parallel-cli and polling for enriched results. Main concerns are supply-chain and data-exposure: the README explicitly endorses a curl | bash installer (high-risk), lacks integrity/verification guidance, and does not warn about uploading sensitive data or handling API keys safely. Recommendations: avoid executing remote install scripts without verifying their contents and signatures; prefer reproducible installs (pipx with pinned versions) or vendor-signed installers; explicitly warn users about uploading sensitive/PII data and surface links to privacy/retention policies; encourage scoped API keys and local validation before automatic background uploads. If these mitigations cannot be followed, treat the installer step and CLI execution as high-risk.

Confidence: 98%Severity: 90%
Audit Metadata
Analyzed At
Mar 3, 2026, 04:27 PM
Package URL
pkg:socket/skills-sh/parallel-web%2Fparallel-agent-skills%2Fparallel-data-enrichment%2F@403218e5f8abb9094a36846dcec7fa22b999818b