Pinecone

Pinecone vector database — manage indexes, upsert vectors, query similarity search, manage namespaces, and track collections via the Pinecone API. Build sema...

Security Scan

The skill largely matches a Pinecone CLI, but its runtime script reads a user's local .env/workspace file (not declared in SKILL.md), contains multiple incorrect API method/path usages, and therefore has inconsistencies you should review before installing.

Purpose & Capability

Name, description, and declared PINECONE_API_KEY requirement align with a Pinecone CLI. However, the implementation contains many incorrect HTTP methods/paths (e.g., upsert/query using GET, unusual /index vs /indexes usage) suggesting the code is buggy or not the official Pinecone API shape. These are coherence/quality issues but do not by themselves imply malicious intent.

Instruction Scope

SKILL.md states requests go directly to Pinecone and that nothing is stored locally, but the script will try to read a local .env file at WORKSPACE or ~/.openclaw/workspace/.env to extract PINECONE_API_KEY if the environment variable is absent. That local-file access is not declared in the metadata and is a scope mismatch (it reads user files to obtain credentials).

Install Mechanism

No install spec is provided (instruction-only with an included script). This is low-risk from an installation perspective because nothing arbitrary is downloaded or written by an installer.

Credentials

The only declared credential is PINECONE_API_KEY, which is appropriate. However, the script also reads WORKSPACE (to locate a .env file) and will parse that file for PINECONE_API_KEY if the env var is missing; those additional environment/config accesses are not declared in requires.env and may expose or depend on local files containing secrets.

Persistence & Privilege

The skill does not request always:true, does not modify other skills, and does not attempt to persist or enable itself. It runs as a normal, user-invoked CLI script.

What to consider before installing

This skill's purpose (Pinecone CLI) is reasonable and the single required secret (PINECONE_API_KEY) matches the purpose — but the script reads a local .env file at WORKSPACE or ~/.openclaw/workspace/.env to find that key if the environment variable is missing. That local-file access is not documented in SKILL.md. Actionable steps before installing or using: 1) Inspect or run the script in an isolated environment (container/VM). 2) If you store secrets in ~/.openclaw/workspace/.env, be aware the skill will read it; consider rotating the Pinecone key or removing it from that file. 3) Ask the publisher to declare the .env fallback in SKILL.md (or remove the fallback) and to fix the HTTP method/path bugs — the current implementation appears buggy and may fail or behave unexpectedly. 4) If you don't trust the author, avoid installing; else test with a limited-scoped Pinecone key and monitor network requests. If you want, I can point out the exact lines to change to remove the .env fallback and to correct the API calls.

Pinecone vector database — manage indexes, upsert vectors, query similarity search, manage namespaces, and track collections via the Pinecone API.

Features

• Index management — create, configure, delete indexes
• Vector upsert — insert and update vectors with metadata
• Similarity search — query nearest neighbors
• Namespace management — organize vectors by namespace
• Metadata filtering — filter queries by metadata fields
• Collection management — create snapshots of indexes
• Batch operations — bulk upsert and delete
• Index stats — vector counts, dimensions, usage
• Sparse-dense — hybrid search with sparse vectors
• Serverless — auto-scaling serverless indexes

Requirements

Variable	Required	Description
PINECONE_API_KEY	✅	API key/token for Pinecone

Quick Start

# List indexes
python3 {baseDir}/scripts/pinecone.py indexes

# Get index details
python3 {baseDir}/scripts/pinecone.py index-get my-index

# Create an index
python3 {baseDir}/scripts/pinecone.py index-create '{"name":"my-index","dimension":1536,"metric":"cosine","spec":{"serverless":{"cloud":"aws","region":"us-east-1"}}}'

# Delete an index
python3 {baseDir}/scripts/pinecone.py index-delete my-index

Commands

indexes

List indexes.

python3 {baseDir}/scripts/pinecone.py indexes

index-get

Get index details.

python3 {baseDir}/scripts/pinecone.py index-get my-index

index-create

Create an index.

python3 {baseDir}/scripts/pinecone.py index-create '{"name":"my-index","dimension":1536,"metric":"cosine","spec":{"serverless":{"cloud":"aws","region":"us-east-1"}}}'

index-delete

Delete an index.

python3 {baseDir}/scripts/pinecone.py index-delete my-index

upsert

Upsert vectors.

python3 {baseDir}/scripts/pinecone.py upsert --index my-index '{"vectors":[{"id":"vec1","values":[0.1,0.2,...],"metadata":{"text":"hello"}}]}'

query

Query similar vectors.

python3 {baseDir}/scripts/pinecone.py query --index my-index '{"vector":[0.1,0.2,...],"topK":10,"includeMetadata":true}'

fetch

Fetch vectors by ID.

python3 {baseDir}/scripts/pinecone.py fetch --index my-index --ids vec1,vec2,vec3

delete

Delete vectors.

python3 {baseDir}/scripts/pinecone.py delete --index my-index --ids vec1,vec2

delete-namespace

Delete all vectors in namespace.

python3 {baseDir}/scripts/pinecone.py delete-namespace --index my-index --namespace docs

stats

Get index statistics.

python3 {baseDir}/scripts/pinecone.py stats --index my-index

collections

List collections.

python3 {baseDir}/scripts/pinecone.py collections

collection-create

Create collection from index.

python3 {baseDir}/scripts/pinecone.py collection-create '{"name":"backup","source":"my-index"}'

namespaces

List namespaces in index.

python3 {baseDir}/scripts/pinecone.py namespaces --index my-index

Output Format

All commands output JSON by default. Add --human for readable formatted output.

# JSON (default, for programmatic use)
python3 {baseDir}/scripts/pinecone.py indexes --limit 5

# Human-readable
python3 {baseDir}/scripts/pinecone.py indexes --limit 5 --human

Script Reference

Script	Description
{baseDir}/scripts/pinecone.py	Main CLI — all Pinecone operations

Data Policy

This skill never stores data locally. All requests go directly to the Pinecone API and results are returned to stdout. Your data stays on Pinecone servers.

Credits

---

Built by M. Abidi | agxntsix.ai YouTube | GitHub Part of the AgxntSix Skill Suite for OpenClaw agents.

📅 Need help setting up OpenClaw for your business? Book a free consultation