pckle
Warn
Audited by Socket on Mar 16, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS: the skill’s stated Pinecone affiliation does not match its actual footprint. It requires an undocumented/unverifiable `pckle` binary, installs it via arbitrary-host pipe-to-shell, and forwards Pinecone API credentials and user queries to unverified `pckle` endpoints. This is disproportionate and fails install-trust and data-flow integrity checks.
Confidence: 92%Severity: 90%
Audit Metadata