Pinecone Search

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:29 PM UTC
• Version: 0.1.3

Overview

This skill does what it says, but it can send local document contents and paths to external services and its dry-run mode may still create a remote Pinecone index.

Review before installing if you handle confidential documents. Use it only with approved Pinecone and embedding accounts, avoid broad/private directories, expect uploaded text and paths to persist in Pinecone, and do not rely on --dry-run as non-mutating unless the code is fixed to avoid remote initialization and index creation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: upload.py:148
• Finding: Dry-run mode can create a remote Pinecone index## Vulnerability Details **File Location**: `upload.py:148-151`, `upload.py:174-207`, and `pinecone_tool.py:390-412` **Vulnerability Type**: Unexpected remote state modification caused by eager service initialization **Risk Level**: Medium ### Vulnerable Code ```python # upload.py:148-151 # 初始化知识库 kb = KnowledgeBase(config) # 收集所有要处理的文件 ``` ```python # upload.py:174-207 # 预览模式 if args.dry_run: print("预览模式（不实际上传）\n") all_files = [] # 收集单个文件 for file_path in files_to_process: doc = kb.loader.load(file_path) if doc: all_files.append(doc) # 收集目录文件 for dir_path in directories_to_process: docs = kb.loader.load_directory(dir_path, args.recursive) all_files.extend(docs) print(f"找到 {len(all_files)} 个文件:\n") total_chunks = 0 for doc in all_files: chunks = kb.splitter.split(doc) total_chunks += len(chunks) print(f" {doc.filename}") print(f" 路径: {doc.source}") print(f" 类型: {doc.file_type}") print(f" 大小: {format_size(doc.metadata.get('size_bytes', 0))}") print(f" 预计块数: {len(chunks)}") print() print(f"\n预计总块数: {total_chunks}") print("\n预览完成，移除 --dry-run 参数执行实际上传") return ``` ```python # pinecone_tool.py:390-412 class PineconeManager: """Pinecone 管理器 - 封装所有 Pinecone 操作""" MAX_BATCH_SIZE_MB = 2 # Pinecone 单批次限制 2MB def __init__(self, config: Config): self.config = config self.pc = Pinecone(api_key=config.PINECONE_API_KEY) self.index = self._get_or_create_index() def _get_or_create_index(self): """获取或创建索引""" index_name = self.config.INDEX_NAME # 检查索引是否存在 if index_name not in self.pc.list_indexes().names(): print(f"📝 创建索引: {index_name}") self.pc.create_index( name=ind ...[truncated 2268 chars]
• Remediation: ## Remediation Suggestions 1. Evaluate `args.dry_run` before constructing any object that initializes a remote service. 2. In dry-run mode, instantiate only `DocumentLoader` and `TextSplitter`, which are the components required for local preview processing. 3. Refactor `KnowledgeBase` to initialize `PineconeManager` lazily when an upload or search operation first requires it. 4. Separate index lookup from index creation. Index creation should require an explicit upload operation or a dedicated `--create-index` option. 5. Add an automated test that runs dry-run with a mocked Pinecone client and asserts that `list_indexes`, `create_index`, `upsert`, and `query` are never called. 6. Document that dry-run performs no embedding requests, Pinecone requests, resource creation, or vector uploads.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Unpinned dependency ranges permit uncontrolled future package versions## Vulnerability Details **File Location**: `requirements.txt:1-7` and `SKILL.md:56-57` **Vulnerability Type**: Non-reproducible dependency resolution and software supply-chain exposure **Risk Level**: Low ### Vulnerable Code ```text # requirements.txt:1-7 openai>=1.0.0 pinecone>=5.0.0 python-dotenv>=1.0.0 tiktoken>=0.5.0 pydantic>=2.0.0 pydantic-settings>=2.0.0 chardet>=5.0.0 ``` ```bash # SKILL.md:56-57 pip install -r requirements.txt cp config.example.env .env ``` ### Technical Analysis Every dependency uses an open-ended minimum-version constraint. These constraints allow the package installer to select any future release satisfying the minimum version, including releases that were not tested or reviewed with this project. The repository contains no reviewed lock file and no package hashes. As a result, installations performed at different times can resolve to different code. If an upstream package or release channel is compromised, or a future release introduces unsafe behavior, users following the documented installation procedure may install and execute that code under their own account. This finding does not establish that any currently listed dependency is malicious. The weakness is the absence of reproducible and integrity-verified dependency resolution. ### Attack Path 1. A user follows the documented command `pip install -r requirements.txt`. 2. The package resolver queries the configured Python package index. 3. Because only minimum versions are specified, it selects the newest versions available at installation time. 4. A compromised, malicious, or unexpectedly incompatible future release can be downloaded without any repository change. 5. Dependency installation hooks or imported runtime code execute with the privileges of the user running the Skill. ### Impact Assessment Exploitation depends on compromise or unsafe behavior in an accepted dependency rele ...[truncated 493 chars]
• Remediation: ## Remediation Suggestions 1. Generate and commit a lock file containing exact, tested dependency versions. 2. Use hashes for all resolved distributions, such as a hash-locked requirements file installed with `pip --require-hashes`. 3. Separate direct dependency declarations from the fully resolved deployment lock file. 4. Perform dependency upgrades through reviewed pull requests with automated tests and security scanning. 5. Configure trusted package indexes explicitly in deployment environments and avoid unreviewed mirrors. 6. Run tools such as `pip-audit` or an equivalent software composition analysis scanner in CI. 7. Periodically rebuild the lock file so security fixes are adopted deliberately rather than through uncontrolled resolution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description says the skill is for both vector search and document upload for knowledge base management. However, the provided code only performs search-related operations: parsing search arguments, loading config, initializing a knowledge base client, executing kb.search(), and printing results. There is no document ingestion, file reading for upload, indexing, or write/update behavior in this chunk. The primary purpose shown here is search, not upload. Therefore the description overstates the implemented capability in the supplied code.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
pip install -r requirements.txt
cp config.example.env .env
# 编辑 .env 文件，填入你的 API Key
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
pip install -r requirements.txt
cp config.example.env .env
# 编辑 .env 文件，填入你的 API Key
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
pip install -r requirements.txt
cp config.example.env .env
# 编辑 .env 文件，填入你的 API Key
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
pip install -r requirements.txt
cp config.example.env .env
# 编辑 .env 文件，填入你的 API Key
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

NAMESPACE: str = Field("", description="Pinecone Namespace")
    
    class Config:
        env_file = ".env"
        env_file_encoding = "utf-8"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill advertises document upload and embedding through external services but does not warn that file contents and metadata, including filenames and paths, may be transmitted off-host. Users may unknowingly expose sensitive documents, internal directory structures, or proprietary knowledge-base contents to Pinecone and the embedding provider.

External Transmission

Medium

• Category: Data Exfiltration

Content

```env
PINECONE_API_KEY=your_pinecone_api_key
EMBEDDING_API_KEY=your_embedding_api_key
EMBEDDING_BASE_URL=https://api.openai.com/v1
EMBEDDING_MODEL=text-embedding-3-large
INDEX_NAME=your-index-name
NAMESPACE=（可选，默认为default）

• Confidence: 88% confidence
• Finding: The skill is configured to send data to an external embedding API endpoint, which is expected functionality but still creates a real data-exposure risk. Any uploaded document chunks and search queries may leave the local environment, so misuse or accidental invocation could leak confidential information.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger keywords are broad terms like '标准', '规范', and '查询资料', which are likely to appear in many unrelated conversations. This can cause unintended invocation of a skill that performs external search/upload actions, increasing the chance that user queries or local documents are sent to third-party services without clear intent.

External Transmission

Medium

• Category: Data Exfiltration

Content

EMBEDDING_API_KEY=your_embedding_api_key_here

# Embedding API base URL (OpenAI compatible)
EMBEDDING_BASE_URL=https://api.openai.com/v1

# 向量嵌入模型
# 示例: text-embedding-3-large, text-embedding-3-small, etc.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code sends raw document chunk contents to an external embeddings service via `self.client.embeddings.create(...)` without any explicit consent flow, warning, or data-classification check. In a knowledge-base upload tool, users may provide sensitive internal documents, so silent transfer to a third-party API creates a real confidentiality and compliance risk even if it is part of the intended functionality.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code uploads full chunk text plus detailed metadata including absolute source path, filename, title, and timestamps to Pinecone. This expands external exposure beyond embeddings alone, potentially leaking sensitive document contents and internal filesystem structure to a third-party vector database without explicit disclosure or minimization.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This file includes natural-language descriptions and CLI help text exclusively in Chinese, which forces a specific language on users. The policy requires avoiding language or locale constraints unless the skill offers user choice or clearly documents a justified region-specific need.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The CLI is explicitly designed to upload local documents to Pinecone, but its user-facing help and workflow do not clearly warn that document contents will be transmitted to an external service and likely also to an embedding provider. In an agent/tooling context this increases the risk of accidental disclosure of sensitive local files because users may treat it like a local indexing command rather than a network exfiltration action.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

# 上传单个文件
    for file_path in files_to_process:
        print(f"\n正在上传文件: {file_path}")
        stats = kb.upload_file(
            file_path,
            chunk_size=args.chunk_size,
            chunk_overlap=args.overlap

• Confidence: 91% confidence
• Finding: This code causes local file contents to be uploaded to a remote vector database, which is a real data-exfiltration capability even though it appears to be the stated purpose of the tool. In a knowledge-base management skill that behavior is expected, but it remains security-relevant because an agent or user could pass sensitive paths and unintentionally send confidential material off-host.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This file contains user-facing guidance comments in Chinese alongside English, which imposes a language expectation without explicitly offering users a language or locale choice. The policy requires flagging language or locale constraints when they are not opt-in or clearly justified.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The module docstrings and user-facing print strings are written exclusively in Chinese, which effectively imposes a single language for disclosures and operational messages. The file does not indicate that language is configurable or that users can opt into another locale.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
pinecone>=5.0.0
python-dotenv>=1.0.0
tiktoken>=0.5.0

• Confidence: 97% confidence
• Finding: The dependency is specified with a lower bound only, which allows future unreviewed releases to be installed. This weakens supply-chain control and can introduce breaking changes or newly vulnerable versions without explicit approval.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
pinecone>=5.0.0
python-dotenv>=1.0.0
tiktoken>=0.5.0
pydantic>=2.0.0

• Confidence: 97% confidence
• Finding: The Pinecone package is unpinned, so installs may resolve to different versions over time. In a knowledge-base tool that handles external data and API access, this increases supply-chain risk and reduces reproducibility.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
pinecone>=5.0.0
python-dotenv>=1.0.0
tiktoken>=0.5.0
pydantic>=2.0.0
pydantic-settings>=2.0.0

• Confidence: 98% confidence
• Finding: Using python-dotenv with only a minimum version allows pip to select any newer release, including versions later found vulnerable. Because this skill likely loads environment-based secrets, dependency drift in this package is particularly undesirable.

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: The manifest does not pin python-dotenv, and the package has known advisories affecting some versions. Because this tool likely manages API keys and may modify or read .env files, an affected version could increase the risk of secret exposure or arbitrary file overwrite in certain workflows.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
pinecone>=5.0.0
python-dotenv>=1.0.0
tiktoken>=0.5.0
pydantic>=2.0.0
pydantic-settings>=2.0.0
chardet>=5.0.0

• Confidence: 95% confidence
• Finding: The tiktoken dependency is not fixed to a specific version, so builds are not reproducible and may pick up unreviewed upstream changes. This is a standard supply-chain hardening issue even if no specific exploit is evident here.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pinecone>=5.0.0
python-dotenv>=1.0.0
tiktoken>=0.5.0
pydantic>=2.0.0
pydantic-settings>=2.0.0
chardet>=5.0.0

• Confidence: 98% confidence
• Finding: An unpinned pydantic dependency permits installation of varying versions, including ones with known historical vulnerabilities or future regressions. Since pydantic often processes untrusted input, version control matters for security and stability.

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: Pydantic has known advisories in some versions, and the unpinned requirement makes it impossible to verify whether installs are safe. In a service that validates external documents or user-supplied metadata, vulnerable parsing or regex behavior could enable denial of service or other input-handling issues.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-dotenv>=1.0.0
tiktoken>=0.5.0
pydantic>=2.0.0
pydantic-settings>=2.0.0
chardet>=5.0.0

• Confidence: 97% confidence
• Finding: The pydantic-settings package is unpinned, allowing unreviewed versions to be installed automatically. In a tool that likely reads configuration and secrets, this creates unnecessary supply-chain and configuration-handling risk.

Static analysis

No suspicious patterns detected.