Maintenance sweep: pinecone-claude-code-plugin

[jhamon]

Maintenance sweep for pinecone-claude-code-plugin, triaged against the seven-theme repo-audit checklist (PIN-2 baseline). Substantive items are tracked as child issues (auto-updating status); trivia are bare checkboxes below.

Repo type: Claude Code plugin / marketplace (Python skill scripts + bash SessionStart hook + JSON manifests + Markdown skills). Description ✅, topics ✅, MIT LICENSE ✅ (verified), releases + changelog ✅, Dependabot 0 open.

Theme 1 — Discoverability & Presentation

Description, topics, README, LICENSE (MIT), and automated releases/changelog are all in good shape. Minor gaps:

• Set the GitHub homepage URL (currently empty) — e.g. gh repo edit --homepage https://docs.pinecone.io/...
• Confirm community-health coverage (CONTRIBUTING / CODE_OF_CONDUCT / SECURITY / issue templates) — verify the org .github defaults apply, or add repo-local files

Theme 2 — Cleanup & Repo Hygiene

Repo is clean (no scaffold cruft, no committed build output/secrets). Minor:

• plugin.json description says quickstart is used to "generate AGENTS.md files and initialize Python projects" — the shipped quickstart skill now offers Database/Assistant paths and does not generate AGENTS.md; sync the description with reality
• Cosmetic: .mcp.json has trailing-whitespace lines; skills/assistant/scripts/chat.py:50 missing a space after the comma in Pinecone(api_key=api_key,source_tag=...)

Theme 3 — Testing + CI Foundation (the safety net)

• Add validation/test CI for plugin manifests, skills, and scripts #28 — Add validation/test CI for plugin manifests, skills, and scripts (no test/validation workflow exists; local tests are gitignored)

Theme 4 — Dependency Hygiene

Dependabot 0 open. Fleet-wide critical/high Dependabot handled by the separate Security fast-track.

• Dependency hygiene: pin MCP server and declare Python script dependencies #30 — Pin MCP server (npx @pinecone-database/mcp floats to latest) and declare Python script dependencies (depends on Add validation/test CI for plugin manifests, skills, and scripts #28)

Theme 5 — Security

• Resolve 4 open code-scanning alerts (untrusted checkout + unpinned actions) #29 — Resolve 4 open code-scanning alerts: untrusted-checkout ×2 (contextualize-skills.yml) + unpinned-tag ×2 (claude.yml, contextualize-skills.yml)

Theme 6 — Docs

README is comprehensive and current (FTS pinecone>=9.0 note present, install paths documented). Only drift is the plugin.json AGENTS.md description noted under Theme 2 — no separate doc issue.

Theme 7 — UX & Small Correctness Fixes

Hook script is robust (opt-out env var, jq/python3/bash JSON-escaping fallbacks). No substantive bugs found; the two cosmetic nits are under Theme 2.

---

Sequencing: #28 (safety net) → #30 (dep pinning, verified by #28) and #29 (security, verified against the sync PR flow). Encoded as Depends on in the child bodies.