setup

Fail

Audited by Socket on Mar 3, 2026

1 alert found:

Malware
MalwareHIGH
SKILL.md

The setup instructions are functionally consistent with installing and authenticating the Parallel CLI, but they include a high-risk install pattern: an unpinned curl|bash pipeline that downloads and immediately executes a remote script. This download-and-execute pattern is a supply-chain risk even if the domain is legitimate. The pipx alternative is preferable but still installs third-party code. No explicit exfiltration or obfuscated/malicious code is present in the provided fragment itself, but the instructions enable potentially dangerous behavior depending on the content of the remote installer. Treat the curl|bash install as high-risk and inspect or verify the installer before running.

Confidence: 95%Severity: 90%
Audit Metadata
Analyzed At
Mar 3, 2026, 01:08 AM
Package URL
pkg:socket/skills-sh/parallel-web%2Fparallel-agent-skills%2Fsetup%2F@7fec1541066d4e3aebeb8667130d69d6f66bcd78