pinecone:full-text-search
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill retrieves the
PINECONE_API_KEYfrom the environment viaos.environ.get, which is a secure practice for handling sensitive credentials and avoids hardcoding secrets. - [COMMAND_EXECUTION]: The skill uses a packaged Python script (
scripts/ingest.py) for data ingestion. The script implements batched upserts, explicit error reporting for each batch, and readiness polling to ensure data is searchable before the process completes, which prevents silent failures and data-plane race conditions. - [EXTERNAL_DOWNLOADS]: The ingestion script specifies official and versioned dependencies (
pinecone==9.0.0andtyper) from standard package registries, which are appropriate for the skill's functionality. - [INDIRECT_PROMPT_INJECTION]: While the skill processes external data files (JSONL), it mitigates risks by requiring the agent to perform an onboarding walkthrough where the data shape is summarized and schema decisions are explicitly approved by the user before execution.
- [SAFE]: The skill emphasizes the immutability of Pinecone preview schemas and requires user confirmation before index creation, preventing accidental resource allocation or data loss due to misconfiguration.
Audit Metadata