provider-upgrade
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions to download the
schema-toolsutility from Pulumi's official GitHub repository (github.com/pulumi/schema-tools). This tool is used to perform structured comparisons between provider versions to identify breaking changes. - [COMMAND_EXECUTION]: The skill utilizes several CLI tools to perform its tasks, including
pulumi previewfor infrastructure diffing,pulumi stack exportfor state inspection, and standard package managers (npm,pip,go,dotnet) for dependency updates. It also usesjqandgrepto parse and filter state data. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data by exporting and reading Pulumi stack state and provider schemas. While this data could theoretically contain malicious instructions if the underlying infrastructure metadata were compromised, the skill's operational scope is limited to code editing and recommendation. It maintains a strong security posture by explicitly instructing the agent not to run destructive commands like
pulumi uporpulumi destroy.
Audit Metadata