sync: skills update from pinecone-io/skills#15
Merged
arjunpatel7 merged 10 commits intomainfrom Mar 4, 2026
Merged
Conversation
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
Contextualization summaryChanges made and why
|
…docs skills - Move scripts from skills/assistant/ to skills/pinecone-assistant/scripts/ - Delete old skills/assistant/ (superseded by skills/pinecone-assistant/) - Delete 9 redundant commands now covered by skills (keep join-discord.md) - Add and contextualize pinecone:cli, pinecone:mcp, pinecone:docs skills Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Update stale slash command references in pinecone-assistant scripts. Old commands (assistant-chat, assistant-upload, etc.) were deleted in the refactor commit; replace with unified /pinecone:assistant references. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
Contextualization SummaryWhat was changed and why
|
The contextualization bot's second run removed closing triple-quotes from f-strings in create.py and list.py, causing SyntaxErrors. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…sing scripts Validate API key by calling list-indexes via Pinecone MCP rather than echoing the env var. Also adds the upsert.py and quickstart_complete.py scripts that SKILL.md references but were never committed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The plugin already namespaces skills with `pinecone:`, so directory names like `pinecone-assistant/` caused double-pinecone confusion (e.g. Claude trying `pinecone:pinecone-assistant`). Renamed all 7 skill dirs to just `assistant/`, `cli/`, `docs/`, `help/`, `mcp/`, `query/`, `quickstart/`. Also updates CLAUDE.md conventions, README (consolidates outdated assistant sub-commands into single skill listing, adds cli/mcp/docs), and adds __pycache__ + test files to .gitignore. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Release workflow: - Trigger on all merged PRs to main (not just sync/skills-*) - Auto-generate CHANGELOG.md entry from PR title/summary Contextualize workflow: - Skip re-runs when last commit is from github-actions[bot] - Restrict Claude to .md files only (don't touch .py scripts) - Add directory rename step (strip pinecone- prefix per CLAUDE.md) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
arjunpatel7
added
the
bump:minor
No longer requires manually editing PR description before merging. Changelog entries are auto-generated from PR commit messages, filtering out chore and automation commits. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| BULLETS=$(gh pr view "$PR_NUMBER" --json commits --jq '.commits[].messageHeadline' | grep -v '^chore:' | grep -v '^\[create-pull-request\]' | sed 's/^/- /') | ||
|
|
||
| if [ -z "$BULLETS" ]; then | ||
| BULLETS="- ${{ github.event.pull_request.title }}" |
Check warning
Code scanning / CodeQL
Code injection Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 13 days ago
In general, to fix code injection in GitHub Actions run: blocks, avoid embedding untrusted ${{ ... }} expressions directly into the shell script. Instead, pass such values via env: (or with: for actions) and then read them using the shell’s native variable expansion ($VAR). This ensures the runner only substitutes the environment value once and the shell interprets it as data, not as part of the script structure.
Here, the risky usage is in the Update changelog step:
68: if [ -z "$BULLETS" ]; then
69: BULLETS="- ${{ github.event.pull_request.title }}"
70: fiWe should add an environment variable, e.g. PR_TITLE: ${{ github.event.pull_request.title }}, in the same step’s env: section, and replace the direct expression in the script with $PR_TITLE using shell syntax. That yields:
env:
NEW_VERSION: ${{ steps.version.outputs.new_version }}
PR_NUMBER: ${{ github.event.pull_request.number }}
PR_TITLE: ${{ github.event.pull_request.title }}
GH_TOKEN: ${{ github.token }}
run: |
...
if [ -z "$BULLETS" ]; then
BULLETS="- $PR_TITLE"
fiThis preserves all existing behavior (still uses the PR title as a fallback bullet) while eliminating the injection risk, because any metacharacters in $PR_TITLE are interpreted as content of the double-quoted string on assignment, not as part of the shell script itself. No additional methods or new imports are needed; only the env: mapping and the BULLETS assignment line must be changed, all within .github/workflows/release.yml in the shown step.
Suggested changeset
1
.github/workflows/release.yml
| @@ -57,6 +57,7 @@ | ||
| env: | ||
| NEW_VERSION: ${{ steps.version.outputs.new_version }} | ||
| PR_NUMBER: ${{ github.event.pull_request.number }} | ||
| PR_TITLE: ${{ github.event.pull_request.title }} | ||
| GH_TOKEN: ${{ github.token }} | ||
| run: | | ||
| DATE=$(date +%Y-%m-%d) | ||
| @@ -66,7 +67,7 @@ | ||
| BULLETS=$(gh pr view "$PR_NUMBER" --json commits --jq '.commits[].messageHeadline' | grep -v '^chore:' | grep -v '^\[create-pull-request\]' | sed 's/^/- /') | ||
|
|
||
| if [ -z "$BULLETS" ]; then | ||
| BULLETS="- ${{ github.event.pull_request.title }}" | ||
| BULLETS="- $PR_TITLE" | ||
| fi | ||
|
|
||
| # Build the new changelog entry | ||
| @@ -78,7 +79,6 @@ | ||
| else | ||
| # No header found — prepend entry to file | ||
| printf '%s\n\n%s' "$ENTRY" "$(cat CHANGELOG.md)" > CHANGELOG.md | ||
| fi | ||
|
|
||
| - name: Commit and tag | ||
| run: | |
Copilot is powered by AI and may make mistakes. Always verify output.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated skill sync from pinecone-io/skills — run #3.
Changed files:
The contextualization workflow will run automatically on this branch to adapt these skills for this IDE. Review both the raw sync and Claude's adaptations before merging.