package-usage
Pass
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill interacts with official Pulumi API endpoints to retrieve package metadata and stack usage information. These operations are consistent with the skill's stated purpose of cross-stack auditing.
- [SAFE]: Data access is properly scoped using the organization name provided by the user or the
PULUMI_ORGenvironment variable, which is standard practice for Pulumi's operational environment. - [SAFE]: The instructions include clear scope boundaries, explicitly delegating state-changing operations (like package upgrades) to other specialized skills, which follows the principle of least privilege.
- [SAFE]: Analysis of the metadata and documentation found no evidence of prompt injection, obfuscation, or persistence mechanisms.
Audit Metadata