parallel-data-enrichment
Audited by Socket on Mar 3, 2026
1 alert found:
MalwareFunctionally, the module/skill is consistent: it automates uploading user data to Parallel.ai via parallel-cli and polling for enriched results. Main concerns are supply-chain and data-exposure: the README explicitly endorses a curl | bash installer (high-risk), lacks integrity/verification guidance, and does not warn about uploading sensitive data or handling API keys safely. Recommendations: avoid executing remote install scripts without verifying their contents and signatures; prefer reproducible installs (pipx with pinned versions) or vendor-signed installers; explicitly warn users about uploading sensitive/PII data and surface links to privacy/retention policies; encourage scoped API keys and local validation before automatic background uploads. If these mitigations cannot be followed, treat the installer step and CLI execution as high-risk.