api-vector-db-pinecone
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the
@pinecone-database/pineconepackage (v7.x) for interacting with Pinecone's vector database services. This is a well-known library for an established service. - [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for ingesting untrusted external data (document content and metadata) into the Pinecone index via
upsertandupsertRecordsmethods (documented inexamples/core.mdandexamples/inference.md). This data is later retrieved through similarity search to provide context for AI agents. The skill includes recommendations for metadata filtering and namespace isolation to manage data boundaries, though users should ensure retrieved context is treated as untrusted. - [CREDENTIALS_UNSAFE]: The skill correctly emphasizes storing the
PINECONE_API_KEYin environment variables rather than hardcoding it, providing explicit examples of secure vs. insecure implementation inSKILL.mdandexamples/core.md.
Audit Metadata