Pinecone

• Analyzed: Apr 30, 2026, 4:02 PM
• Findings: 1
• Version: 1.0.2
• Hash: 152358990883335d567f8b753eb468cf90bc8bcd0a482a66e45cf3c28c36f1b9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructs the AI agent to perform high-risk operations including installing a global NPM package (`@membranehq/cli`) and routing all Pinecone database traffic and authentication through a third-party proxy service (`getmembrane.com`). While these actions are aligned with the stated purpose of using the Membrane platform, they introduce significant supply-chain risks and potential data exposure by intercepting sensitive API interactions. (SKILL.md)