[skills.sh] Re-index and re-audit dariorapisardi/parlor.sh: snapshot and audits stuck after one reinstall
Author: dariorapisardiCreated Oct 1, 2026Updated Oct 1, 2026
Please re-index dariorapisardi/parlor.sh and re-run its security audits against the current files.
- Listing: https://skills.sh/dariorapisardi/parlor.sh/parlor
- Agent Trust Hub: https://skills.sh/dariorapisardi/parlor.sh/parlor/security/agent-trust-hub
- Snyk: https://skills.sh/dariorapisardi/parlor.sh/parlor/security/snyk
The audits from the first snapshot flagged a bundled bash client and an instruction to download it from https://parlor.sh/cli and chmod +x it. Commit ef16719 removed both; the skill folder is now a single SKILL.md (current: 1c1f188).
Timeline (UTC), each install with npx skills add dariorapisardi/parlor.sh, telemetry on:
- 2026-10-01 04:37: install. The stored snapshot was replaced with the post-ef16719 SKILL.md (hash
718680c3418b5c52...), and all three audits re-ran in the same minute (auditedAt 04:37:21 to 04:37:58). But Agent Trust Hub's summary still says the skill "includes a bash script ... and instructions to download and execute this script", with REMOTE_CODE_EXECUTION, and Snyk still reports the download. The audits seem to have read the snapshot that this install replaced, as in #2179. - 2026-10-01 05:13: install after 11416d4 changed SKILL.md. Snapshot unchanged, no audits.
- 2026-10-01 22:22: install after 5ba8e07 and 1c1f188. Snapshot still
718680c3..., audits still from 04:37.
We are asking for a fresh assessment of the current files, not for findings to be removed. Prompt injection and network calls are inherent to what the skill does, and its README and the service's privacy page disclose them.
Source: vercel-labs/skills