by 安全扫描
OpenClaw
可疑
medium confidenceThe skill mostly does what it says (wraps Parallel.ai APIs) but has inconsistent handling of credentials (a hard-coded API key fallback), uses undeclared environment variables for authenticated browsing, and exposes webhook/third-party integrations that increase exfiltration risk — review before installing.
评估建议
This skill appears to implement a legitimate Parallel.ai client, but there are a few red flags to review before installing:
- Inspect and remove the hard-coded API key in scripts/search.py. A hard-coded fallback means the skill may run using a credential you don't control; this can incur costs or leak usage to someone else. Replace it with strict failure when PARALLEL_API_KEY is missing or document an explicit demo key policy.
- Be aware of optional env vars not declared in the registry (BROWS...详细分析 ▾
✓ 用途与能力
Name/description match the files and runtime instructions: the scripts call Parallel.ai search, extract, findall, monitor, task, and task-run endpoints. Required PARALLEL_API_KEY is appropriate for this purpose.
⚠ 指令范围
Most instructions stay within the declared purpose (calls to Parallel.ai). However the skill accepts webhook URLs (monitor.create) and allows passing 'mcp_servers' for authenticated browsing (task.py), which cause data or credentials to be sent to third parties. search.py falls back to a hard-coded API key if PARALLEL_API_KEY is not set (inconsistent with other scripts that exit), which means the skill can operate under an embedded credential you did not provide.
✓ 安装机制
This is instruction-only (no install spec that downloads arbitrary archives). It uses Python scripts and recommends 'pip install parallel-web' which is a normal package install; no unusual installers or remote extracts are present.
⚠ 凭证需求
Declared primaryEnv is only PARALLEL_API_KEY which is appropriate. But the code optionally uses other env vars not declared in metadata (BROWSERUSE_API_KEY for authenticated browsing, PARALLEL_MAX_WAIT) and search.py contains a hard-coded fallback API key string. Requiring or using extra credentials without declaring them and embedding an API key are disproportionate and risky.
✓ 持久化与权限
The skill does not request always:true, does not modify other skills, and contains no code that persists itself into global agent config. Autonomous invocation is allowed (default) but not combined with other high privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.12026/1/25
Fix display name (remove Clawdbot prefix)
● 可疑
安装命令
点击复制官方npx clawhub@latest install parallel
镜像加速npx clawhub@latest install parallel --registry https://cn.longxiaskill.com 镜像可用
本土化适配说明
Parallel — 技能工具 安装说明： 安装命令：npx clawhub@latest install parallel 支持国内镜像加速，使用 --registry https://cn.longxiaskill.com 参数可加速下载
技能文档
High-accuracy web search API built for AI agents. Outperforms Perplexity/Exa on research benchmarks.
Setup
pip install parallel-web
API key is configured. Uses Python SDK.
from parallel import Parallel
client = Parallel(api_key="YOUR_KEY")
response = client.beta.search(
mode="one-shot", # or "fast" for lower latency/cost, "agentic" for multi-hop
max_results=10,
objective="your query"
)
Modes
| Mode | Use Case | Tradeoff |
|---|---|---|
one-shot | Default, balanced accuracy | Best for most queries |
fast ⚡ | Quick lookups, cost-sensitive | Lower latency/cost, may sacrifice some accuracy |
agentic | Complex multi-hop research | Higher accuracy, more expensive |
Quick Usage
# Default search (one-shot mode) {baseDir}/.venv/bin/python {baseDir}/scripts/search.py "Who is the CEO of Anthropic?" --max-results 5# Fast mode - lower latency/cost ⚡ {baseDir}/.venv/bin/python {baseDir}/scripts/search.py "latest AI news" --mode fast
# Agentic mode - complex research {baseDir}/.venv/bin/python {baseDir}/scripts/search.py "compare transformer architectures" --mode agentic
# JSON output {baseDir}/.venv/bin/python {baseDir}/scripts/search.py "latest AI news" --json
Response Format
Returns structured results with:
search_id- unique search identifierresults[]- array of results with:
url - source URL
- title - page title
- excerpts[] - relevant text excerpts
- publish_date - when available
usage- API usage stats
When to Use
- Deep research requiring cross-referenced facts
- Company/person research with citations
- Fact-checking with evidence-based outputs
- Complex queries that need multi-hop reasoning
- Higher accuracy than traditional search for research tasks
API Reference
Docs: https://docs.parallel.ai Platform: https://platform.parallel.ai