api-vector-db-pinecone

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the @pinecone-database/pinecone package (v7.x) for interacting with Pinecone's vector database services. This is a well-known library for an established service.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for ingesting untrusted external data (document content and metadata) into the Pinecone index via upsert and upsertRecords methods (documented in examples/core.md and examples/inference.md). This data is later retrieved through similarity search to provide context for AI agents. The skill includes recommendations for metadata filtering and namespace isolation to manage data boundaries, though users should ensure retrieved context is treated as untrusted.
  • [CREDENTIALS_UNSAFE]: The skill correctly emphasizes storing the PINECONE_API_KEY in environment variables rather than hardcoding it, providing explicit examples of secure vs. insecure implementation in SKILL.md and examples/core.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 01:03 PM