Security audit

Pinecone Search

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can send local document contents and paths to external services and its dry-run mode may still create a remote Pinecone index.

Review before installing if you handle confidential documents. Use it only with approved Pinecone and embedding accounts, avoid broad/private directories, expect uploaded text and paths to persist in Pinecone, and do not rely on --dry-run as non-mutating unless the code is fixed to avoid remote initialization and index creation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: upload.py:148
Finding: Dry-run mode can create a remote Pinecone index
Content: View full analysis
Vulnerability Details

File Location: upload.py:148-151, upload.py:174-207, and pinecone_tool.py:390-412
Vulnerability Type: Unexpected remote state modification caused by eager service initialization
Risk Level: Medium

Vulnerable Code

python
# upload.py:148-151 # 初始化知识库 kb = KnowledgeBase(config) # 收集所有要处理的文件

python
# upload.py:174-207 # 预览模式 if args.dry_run: print("预览模式（不实际上传）\n") all_files = [] # 收集单个文件 for file_path in files_to_process: doc = kb.loader.load(file_path) if doc: all_files.append(doc) # 收集目录文件 for dir_path in directories_to_process: docs = kb.loader.load_directory(dir_path, args.recursive) all_files.extend(docs) print(f"找到 {len(all_files)} 个文件:\n") total_chunks = 0 for doc in all_files: chunks = kb.splitter.split(doc) total_chunks += len(chunks) print(f" {doc.filename}") print(f" 路径: {doc.source}") print(f" 类型: {doc.file_type}") print(f" 大小: {format_size(doc.metadata.get('size_bytes', 0))}") print(f" 预计块数: {len(chunks)}") print() print(f"\n预计总块数: {total_chunks}") print("\n预览完成，移除 --dry-run 参数执行实际上传") return

python
# pinecone_tool.py:390-412 class PineconeManager: """Pinecone 管理器 - 封装所有 Pinecone 操作""" MAX_BATCH_SIZE_MB = 2 # Pinecone 单批次限制 2MB def __init__(self, config: Config): self.config = config self.pc = Pinecone(api_key=config.PINECONE_API_KEY) self.index = self._get_or_create_index() def _get_or_create_index(self): """获取或创建索引""" index_name = self.config.INDEX_NAME # 检查索引是否存在 if index_name not in self.pc.list_indexes().names(): print(f"📝 创建索引: {index_name}") self.pc.create_index( name=ind ...[truncated 2268 chars]
Remediation: View remediation
Remediation Suggestions

Evaluate args.dry_run before constructing any object that initializes a remote service.

In dry-run mode, instantiate only DocumentLoader and TextSplitter, which are the components required for local preview processing.

Refactor KnowledgeBase to initialize PineconeManager lazily when an upload or search operation first requires it.

Separate index lookup from index creation. Index creation should require an explicit upload operation or a dedicated --create-index option.

Add an automated test that runs dry-run with a mocked Pinecone client and asserts that list_indexes, create_index, upsert, and query are never called.

Document that dry-run performs no embedding requests, Pinecone requests, resource creation, or vector uploads.

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unpinned dependency ranges permit uncontrolled future package versions
Content: View full analysis
Vulnerability Details

File Location: requirements.txt:1-7 and SKILL.md:56-57
Vulnerability Type: Non-reproducible dependency resolution and software supply-chain exposure
Risk Level: Low

Vulnerable Code

text
# requirements.txt:1-7 openai>=1.0.0 pinecone>=5.0.0 python-dotenv>=1.0.0 tiktoken>=0.5.0 pydantic>=2.0.0 pydantic-settings>=2.0.0 chardet>=5.0.0

bash
# SKILL.md:56-57 pip install -r requirements.txt cp config.example.env .env

Technical Analysis

Every dependency uses an open-ended minimum-version constraint. These constraints allow the package installer to select any future release satisfying the minimum version, including releases that were not tested or reviewed with this project.

The repository contains no reviewed lock file and no package hashes. As a result, installations performed at different times can resolve to different code. If an upstream package or release channel is compromised, or a future release introduces unsafe behavior, users following the documented installation procedure may install and execute that code under their own account.

This finding does not establish that any currently listed dependency is malicious. The weakness is the absence of reproducible and integrity-verified dependency resolution.

Attack Path

A user follows the documented command pip install -r requirements.txt.

The package resolver queries the configured Python package index.

Because only minimum versions are specified, it selects the newest versions available at installation time.

A compromised, malicious, or unexpectedly incompatible future release can be downloaded without any repository change.

Dependency installation hooks or imported runtime code execute with the privileges of the user running the Skill.

Impact Assessment

Exploitation depends on compromise or unsafe behavior in an accepted dependency rele ...[truncated 493 chars]
Remediation: View remediation
Remediation Suggestions

Generate and commit a lock file containing exact, tested dependency versions.

Use hashes for all resolved distributions, such as a hash-locked requirements file installed with pip --require-hashes.

Separate direct dependency declarations from the fully resolved deployment lock file.

Perform dependency upgrades through reviewed pull requests with automated tests and security scanning.

Configure trusted package indexes explicitly in deployment environments and avoid unreviewed mirrors.

Run tools such as pip-audit or an equivalent software composition analysis scanner in CI.

Periodically rebuild the lock file so security fixes are adopted deliberately rather than through uncontrolled resolution.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says the skill is for both vector search and document upload for knowledge base management. However, the provided code only performs search-related operations: parsing search arguments, loading config, initializing a knowledge base client, executing kb.search(), and printing results. There is no document ingestion, file reading for upload, indexing, or write/update behavior in this chunk. The primary purpose shown here is search, not upload. Therefore the description overstates the implemented capability in the supplied code.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
bash
pip install -r requirements.txt cp config.example.env .env # 编辑 .env 文件，填入你的 API Key

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
bash
pip install -r requirements.txt cp config.example.env .env # 编辑 .env 文件，填入你的 API Key

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · search.py (reported line 118)May include surrounding context.
python
```bash pip install -r requirements.txt cp config.example.env .env # 编辑 .env 文件，填入你的 API Key ```

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · upload.py (reported line 141)May include surrounding context.
python
```bash pip install -r requirements.txt cp config.example.env .env # 编辑 .env 文件，填入你的 API Key ```

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · pinecone_tool.py (reported line 38)May include surrounding context.
python
NAMESPACE: str = Field("", description="Pinecone Namespace") class Config: env_file = ".env" env_file_encoding = "utf-8"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill advertises document upload and embedding through external services but does not warn that file contents and metadata, including filenames and paths, may be transmitted off-host. Users may unknowingly expose sensitive documents, internal directory structures, or proprietary knowledge-base contents to Pinecone and the embedding provider.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The skill is configured to send data to an external embedding API endpoint, which is expected functionality but still creates a real data-exposure risk. Any uploaded document chunks and search queries may leave the local environment, so misuse or accidental invocation could leak confidential information.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
env
PINECONE_API_KEY=your_pinecone_api_key EMBEDDING_API_KEY=your_embedding_api_key EMBEDDING_BASE_URL=https://api.openai.com/v1 EMBEDDING_MODEL=text-embedding-3-large INDEX_NAME=your-index-name NAMESPACE=（可选，默认为default）

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger keywords are broad terms like '标准', '规范', and '查询资料', which are likely to appear in many unrelated conversations. This can cause unintended invocation of a skill that performs external search/upload actions, increasing the chance that user queries or local documents are sent to third-party services without clear intent.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · config.example.env (reported line 10)May include surrounding context.
text
EMBEDDING_API_KEY=your_embedding_api_key_here # Embedding API base URL (OpenAI compatible) EMBEDDING_BASE_URL=https://api.openai.com/v1 # 向量嵌入模型 # 示例: text-embedding-3-large, text-embedding-3-small, etc.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code sends raw document chunk contents to an external embeddings service via self.client.embeddings.create(...) without any explicit consent flow, warning, or data-classification check. In a knowledge-base upload tool, users may provide sensitive internal documents, so silent transfer to a third-party API creates a real confidentiality and compliance risk even if it is part of the intended functionality.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code uploads full chunk text plus detailed metadata including absolute source path, filename, title, and timestamps to Pinecone. This expands external exposure beyond embeddings alone, potentially leaking sensitive document contents and internal filesystem structure to a third-party vector database without explicit disclosure or minimization.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This file includes natural-language descriptions and CLI help text exclusively in Chinese, which forces a specific language on users. The policy requires avoiding language or locale constraints unless the skill offers user choice or clearly documents a justified region-specific need.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The CLI is explicitly designed to upload local documents to Pinecone, but its user-facing help and workflow do not clearly warn that document contents will be transmitted to an external service and likely also to an embedding provider. In an agent/tooling context this increases the risk of accidental disclosure of sensitive local files because users may treat it like a local indexing command rather than a network exfiltration action.
Content: No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: This code causes local file contents to be uploaded to a remote vector database, which is a real data-exfiltration capability even though it appears to be the stated purpose of the tool. In a knowledge-base management skill that behavior is expected, but it remains security-relevant because an agent or user could pass sensitive paths and unintentionally send confidential material off-host.
Content: Scanner excerpt · upload.py (reported line 212)May include surrounding context.
python
# 上传单个文件 for file_path in files_to_process: print(f"\n正在上传文件: {file_path}") stats = kb.upload_file( file_path, chunk_size=args.chunk_size, chunk_overlap=args.overlap

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This file contains user-facing guidance comments in Chinese alongside English, which imposes a language expectation without explicitly offering users a language or locale choice. The policy requires flagging language or locale constraints when they are not opt-in or clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The module docstrings and user-facing print strings are written exclusively in Chinese, which effectively imposes a single language for disclosures and operational messages. The file does not indicate that language is configurable or that users can opt into another locale.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The dependency is specified with a lower bound only, which allows future unreviewed releases to be installed. This weakens supply-chain control and can introduce breaking changes or newly vulnerable versions without explicit approval.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
openai>=1.0.0 pinecone>=5.0.0 python-dotenv>=1.0.0 tiktoken>=0.5.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The Pinecone package is unpinned, so installs may resolve to different versions over time. In a knowledge-base tool that handles external data and API access, this increases supply-chain risk and reduces reproducibility.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
openai>=1.0.0 pinecone>=5.0.0 python-dotenv>=1.0.0 tiktoken>=0.5.0 pydantic>=2.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: Using python-dotenv with only a minimum version allows pip to select any newer release, including versions later found vulnerable. Because this skill likely loads environment-based secrets, dependency drift in this package is particularly undesirable.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
openai>=1.0.0 pinecone>=5.0.0 python-dotenv>=1.0.0 tiktoken>=0.5.0 pydantic>=2.0.0 pydantic-settings>=2.0.0

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The manifest does not pin python-dotenv, and the package has known advisories affecting some versions. Because this tool likely manages API keys and may modify or read .env files, an affected version could increase the risk of secret exposure or arbitrary file overwrite in certain workflows.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The tiktoken dependency is not fixed to a specific version, so builds are not reproducible and may pick up unreviewed upstream changes. This is a standard supply-chain hardening issue even if no specific exploit is evident here.
Content: Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
text
openai>=1.0.0 pinecone>=5.0.0 python-dotenv>=1.0.0 tiktoken>=0.5.0 pydantic>=2.0.0 pydantic-settings>=2.0.0 chardet>=5.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: An unpinned pydantic dependency permits installation of varying versions, including ones with known historical vulnerabilities or future regressions. Since pydantic often processes untrusted input, version control matters for security and stability.
Content: Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.
text
pinecone>=5.0.0 python-dotenv>=1.0.0 tiktoken>=0.5.0 pydantic>=2.0.0 pydantic-settings>=2.0.0 chardet>=5.0.0

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: Pydantic has known advisories in some versions, and the unpinned requirement makes it impossible to verify whether installs are safe. In a service that validates external documents or user-supplied metadata, vulnerable parsing or regex behavior could enable denial of service or other input-handling issues.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The pydantic-settings package is unpinned, allowing unreviewed versions to be installed automatically. In a tool that likely reads configuration and secrets, this creates unnecessary supply-chain and configuration-handling risk.
Content: Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.
text
python-dotenv>=1.0.0 tiktoken>=0.5.0 pydantic>=2.0.0 pydantic-settings>=2.0.0 chardet>=5.0.0

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Tp4

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Missing User Warnings

External Transmission

Vague Triggers

External Transmission

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Cloud Storage Exfiltration

Natural-Language Policy Violations

Natural-Language Policy Violations

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Static analysis