* Prefer pipx install over prebuilt binary in skill setup
Skill registries (clawhub.ai, skills.sh, agent trust hubs) scan the
install path of dependent CLIs through VirusTotal. The prebuilt
parallel-cli is a PyInstaller bundle, and PyInstaller bootloaders are
heuristically flagged by several AV engines — a known false-positive
class with no fix on PyInstaller's side.
Flip every install snippet so `pipx install parallel-web-tools[cli]`
is presented first (pure Python source, nothing to scan) and the
binary install script is offered as a fallback for users without
Python. No tooling change in parallel-web-tools is required.
Touches README.md, skills/setup/SKILL.md, and the Setup section of
each per-skill doc.
* Bump version to 0.3.1
Patch bump for the install-order docs change. Also fix the README
release process which previously omitted .codex-plugin/plugin.json
even though it was historically bumped alongside the others.
* Drop curl|bash entirely; link to docs for install
Static scanners (Agent Trust Hub, ClawHub Code Insight) flag any
'curl ... | bash' string in SKILL.md as REMOTE_CODE_EXECUTION even
when it's a fallback. The previous reordering demoted the finding
but didn't clear it.
Eliminate the curl|bash pattern across the repo:
- Per-feature skills (parallel-deep-research, -data-enrichment,
-web-search, -web-extract, -monitor, -findall): replace the entire
Setup block with a one-line prereq pointing the agent at
docs.parallel.ai/integrations/cli when 'parallel-cli --version'
fails. Matches the cline/create-pull-request pattern: skills
detect-and-link, never auto-install.
- setup skill: keep 'pipx install parallel-web-tools[cli]' as the
single registry-backed install command (Cloudflare-wrangler
pattern), drop the curl|bash fallback, point to the docs page for
alternate methods.
- README: same shape — pipx as the inline command, docs link for
alternates, no embedded curl|bash anywhere.
The scripts/install.sh artifact and the install.sh URL still exist
for human users hitting docs.parallel.ai directly; they're just no
longer surfaced in skill text that scanners ingest.
* Tighten Setup blocks: cover auth, drop stray API key line, link-only setup skill
Three corrections on top of the prior commits:
1. parallel-monitor and parallel-findall had a dangling 'Or set an
API key: export PARALLEL_API_KEY="your-key"' line that survived
the previous edit because it was outside the contiguous block
matched. Removing — leaves no credential-handling examples in
per-feature skills.
2. The per-feature Setup line only checked 'parallel-cli --version',
which catches missing CLI but not unauthenticated CLI. Extend the
guidance to: detect missing CLI OR auth-error-on-later-command,
and route both to the same docs URL. No login/API-key commands
embedded in any feature skill.
3. setup/SKILL.md: drop the embedded 'pipx install ...' command and
route to docs.parallel.ai/integrations/cli for all install
methods. Some scanners classify unpinned package installs as
supply-chain risk; link-only sidesteps that without committing to
a version-pinning treadmill. Also drop curl/pipx from
allowed-tools since the skill no longer invokes them. Auth/verify/
update commands stay since those invoke parallel-cli itself
(post-install) and aren't network installs.
* Update skills for parallel-cli 0.3.0 (v0.3.0)
- Add parallel-findall skill for entity discovery from natural language
- Add parallel-monitor skill for continuous web tracking with webhooks
- parallel-deep-research: rewrite processor table with full lite-fast through
ultra8x-fast tiers, document -fast (cached) vs non-fast (fresh fetch)
distinction, default to --text for markdown reports, add --text-description
steering, document --force for re-polls
- parallel-web-search: document --mode advanced (agentic), --exclude-domains,
--location
- parallel-data-enrichment: document new 'enrich suggest' subcommand for
AI-suggested output columns
- parallel-web-extract: fix bug where -o saved JSON with .md extension; add
--full-content / --no-excerpts flags
- setup: mention 'parallel-cli update' for staying current
- Bump plugin/marketplace versions to 0.3.0; refresh descriptions and keywords
* Address subagent eval findings + add CLI version compatibility guidance
Subagent dry-runs of each updated skill surfaced these issues:
parallel-data-enrichment
- Drop unconditional 'share interaction_id' instruction; enrich run --json
doesn't always return one. Now: capture if present, share if captured.
- Note that the poll output is JSON regardless of file extension (it's
an array of {input, output} objects, not CSV). Recommend .json filename.
- Cross-link 'enrich suggest' output to '--enriched-columns' on enrich run.
parallel-findall
- Warn that -g base produces noisy results (query echoes, no-URL entries);
default to core unless user explicitly accepts noise.
- Add filtering guidance to response format (drop empty URLs, query-echo
entities, category placeholders).
- Show concrete example of the findall enrich output schema JSON.
parallel-monitor
- Add 'simulate' and 'event-group' rows to the action-routing table.
- Document upfront that simulate requires a webhook (errors otherwise).
- Make -n 10 the default for 'monitor list' to avoid megabyte-scale dumps.
parallel-web-search / parallel-web-extract
- Replace bare $FILENAME placeholder usage with concrete worked examples
so literal copy-paste doesn't write to /tmp/.json.
- search: lead 'Parsing results' with 'read from -o file', since stdout
routinely exceeds harness limits.
- extract: add error-handling section for 404 / empty results.
CLI version compatibility
- Mark deep-research / findall / monitor as requiring parallel-cli >= 0.3.0
(in compatibility frontmatter and in-body callout).
- Tell agents to detect 'no such command' / 'no such option' errors and
prompt the user to run 'parallel-cli update'.
- enrichment: gracefully skip 'enrich suggest' on older CLIs.
* Sharpen parallel-data-enrichment to reflect actual enrich run --json output
- enrich run --json returns {taskgroup_id, url, num_runs} only — no
interaction_id field. Stop telling the agent to capture or share one.
- enrichment cannot itself produce an interaction_id, so it cannot be
the source of a follow-up chain. Document this explicitly so agents
don't suggest impossible follow-ups.
- Use the correct API field name 'enriched_columns' (underscore).
- Show how to pass the suggest output through to '--enriched-columns'
on 'enrich run' instead of '--intent'.
- Note that '--target' is unused in --no-wait mode; only the local
'--output' on poll determines where results are saved.
* Tighten skills based on second-round subagent eval
Round 3 dry-runs surfaced smaller secondary issues that round 2 didn't catch:
parallel-data-enrichment
- 'enrich suggest' returns an envelope {title, processor, enriched_columns,
warnings}, not just the array. Tell the agent to extract .enriched_columns,
not pass the whole envelope.
- Document that --enriched-columns and --intent are alternatives, not
combinable; clarify the suggested processor is advisory.
parallel-findall
- 'category/directory pages' rule was under-specified; agent had to guess
whether LinkedIn / YC profile pages counted. List concrete examples
(linkedin.com, ycombinator.com/companies/, crunchbase.com, pitchbook.com).
- Add an explicit sanity-check step for -g base: the base generator can
hallucinate categorical attributes (e.g., returns Cursor as YC W25 when
it's actually S22). Spot-check kept entries against falsifiable attributes
in the user's query and recommend -g core if multiple fail.
parallel-monitor
- 'monitor list' isn't guaranteed to be sorted newest-first; a freshly
created monitor may not appear in the first page. Tell the agent to
prefer 'monitor get $MONITOR_ID' over scanning the list when verifying
creation.
* Address round-4 nits
- enrichment: be prescriptive about passing the suggest-recommended
processor through to 'enrich run --processor' (the tuned recommendation
is the more useful default than letting run pick a fresh one).
- findall: broaden the trigger for recommending '-g core' to include
high noise-filter drop rates (>=40%), not just spot-check failures.
A heavily filtered base run is itself a signal the generator is
unreliable for this query.
- monitor: include 'simulate' and 'event-group' in argument-hint
frontmatter so the slash-command UI shows the full action set.
* Make enrich-suggest fallback wording case- and pattern-tolerant
The actual Click error string is 'No such command \'suggest\'.' (capital N,
quoted argument). Skill's lowercase pattern matched, but barely — make the
fallback trigger broader ('no such command' / 'No such command' / 'unknown
command') and add an explicit 'do not bail' directive so a hesitant agent
falls through to --intent rather than aborting.
* Consolidate commands into skills after Claude Code v2.1.3 merge
Claude Code v2.1.3 merged slash commands and skills into a unified
model. Remove the commands/ directory and convert the 3 standalone
commands (setup, status, result) into proper skills. The 4 wrapper
commands that just delegated to skills are no longer needed. Add
user-invocable and argument-hint frontmatter to all skills. Bump
version to 0.2.0.
* Use parallel-subagent for search and extract skills
Adds agent: parallel-subagent to the forked search and extract skills,
scoping them to Bash-only instead of the default general-purpose agent.
* Qualify agent reference with plugin namespace
Use parallel:parallel-subagent instead of bare parallel-subagent
since the agent is defined in this plugin, not in .claude/agents/.
context: fork now works in Claude Code, so the "Claude Code" sections
that manually spawned subagents via the Task tool are redundant. Replace
with agent: parallel-subagent in frontmatter to use the correct agent
type for the fork.
zhengchaol