ClawHub
Back to skill

Security audit

pinecone-memory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Pinecone memory tool that uploads selected local Markdown memory content to Pinecone and includes user-run maintenance commands.

Install only if you want selected local memory or Markdown files stored in your Pinecone account. Use a scoped Pinecone API key, separate test and production namespaces, review paths before sync or restore, avoid uploading secrets or private notes, and be careful with scheduled heartbeat/sync and cleanup commands because they can create ongoing remote writes or delete namespace data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The heartbeat command is presented as a health check, but when write-probe is enabled by default it inserts a real record into the namespace and never removes it. This creates persistent side effects from an operation users may reasonably expect to be read-only, leading to silent data pollution, storage growth, and possible interference with downstream retrieval or monitoring logic.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly exposes destructive cleanup plus remote sync/restore capabilities, but it does not prominently require user confirmation or warn that local data may be transmitted to Pinecone or deleted from a namespace. In an agent setting, this increases the chance of accidental data exfiltration or unintended destructive actions, especially because the workflow presents these operations as normal management steps.

Static analysis

No suspicious patterns detected.