pulumi-component
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill describes the use of
pulumi package add, which downloads provider plugins and generates SDKs from remote Git repositories or the Pulumi Registry. This is a core feature of the Pulumi ecosystem for sharing reusable infrastructure components. - [COMMAND_EXECUTION]: The documentation provides examples of various CLI commands used for managing infrastructure and publishing packages, including
pulumi up,pulumi package add,pulumi package publish,npm publish, andtwine upload. - [INDIRECT_PROMPT_INJECTION]: The skill defines argument interfaces that accept external configuration data via
Input<T>types. This creates an ingestion surface for data-driven interactions with cloud provider APIs. - Ingestion points: Component constructor argument interfaces defined in
SKILL.md. - Boundary markers: None explicitly mentioned in the provided code patterns.
- Capability inventory: Cloud resource management (S3, ECS, SNS, etc.) and execution of Pulumi CLI operations.
- Sanitization: Relies on Pulumi's internal type system and provider-side validation of resource properties.
Audit Metadata