provider-upgrade

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes instructions to download the schema-tools utility from Pulumi's official GitHub repository (github.com/pulumi/schema-tools). This tool is used to perform structured comparisons between provider versions to identify breaking changes.
  • [COMMAND_EXECUTION]: The skill utilizes several CLI tools to perform its tasks, including pulumi preview for infrastructure diffing, pulumi stack export for state inspection, and standard package managers (npm, pip, go, dotnet) for dependency updates. It also uses jq and grep to parse and filter state data.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data by exporting and reading Pulumi stack state and provider schemas. While this data could theoretically contain malicious instructions if the underlying infrastructure metadata were compromised, the skill's operational scope is limited to code editing and recommendation. It maintains a strong security posture by explicitly instructing the agent not to run destructive commands like pulumi up or pulumi destroy.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 10:26 AM