The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the npx pulumi command to execute infrastructure management tasks across various cloud providers.
Evidence: Examples include npx pulumi do for ad-hoc resources, npx pulumi up for deployments, and npx pulumi preview for change inspection.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch the Pulumi CLI and provider plugins from official registries.
Evidence: The skill uses npx to fetch the pulumi package from the npm registry and notes that pulumi do resolves provider packages through the Pulumi registry.
[REMOTE_CODE_EXECUTION]: Using npx involves downloading and executing code from the npm registry at runtime.
Evidence: The skill notes that npx pulumi works on any machine with Node.js installed and runs the command from the npm registry if the binary is not on the PATH.
[CREDENTIALS_UNSAFE]: The skill documents the handling of ephemeral agent credentials and provides security guidance for secret management.
Evidence: It identifies /tmp/.pulumi/credentials.json as the storage location for ephemeral agent credentials.
Mitigation: The instructions explicitly advise against capturing output from pulumi env open in logs and recommend using env run to mask secrets.

pulumi-overview