The Agent Skills Directory

[SAFE]: The skill interacts with Pinecone's managed RAG service using the official pinecone Python client library. All API communication is directed to legitimate Pinecone infrastructure.
[DATA_EXPOSURE]: The skill requires a PINECONE_API_KEY but correctly instructs the user to provide it via environment variables or a .env file. This approach follows secure development practices by avoiding hardcoded credentials.
[COMMAND_EXECUTION]: The skill facilitates the execution of local management scripts (e.g., create.py, upload.py) via the uv tool. These operations are limited to the skill's own directory and are necessary for its documented functionality.
[INDIRECT_PROMPT_INJECTION]: As a RAG-based tool, the skill ingests user-provided documents that are later used in assistant responses. While this constitutes an attack surface for indirect prompt injection, it is the intended primary purpose of the skill. The implementation does not bypass any safety filters and relies on the underlying Pinecone Assistant service's safety mechanisms.

pinecone:assistant