pulumi-neo-handoff
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands including
git rev-parse,git status, and thepulumiCLI. These operations are used to gather repository metadata (root path, branch name, working tree status) and to launch the downstream agent task. The skill utilizesmktempfor secure temporary file creation and employs proper shell quoting"$(cat "$PROMPT_FILE")"to prevent command injection when passing the prompt to the Pulumi CLI. - [INDIRECT_PROMPT_INJECTION]: As a handoff coordinator, the skill processes conversation history to generate a summary for the Pulumi Neo agent. This creates a surface for indirect prompt injection if malicious instructions were present in the earlier conversation.
- Ingestion points: Conversation history, including decisions made and open questions, is read from the session context to populate the 'Conversation summary' section (SKILL.md).
- Boundary markers: The drafted prompt uses clear Markdown headers (
# Goal,# Repository,# Conversation summary) to delimit the data provided to the next agent. - Capability inventory: The skill can execute shell commands, read git metadata, and invoke the vendor's CLI tool as documented in the Workflow section.
- Sanitization: The skill applies aggressive compression to the summary (targeting ~400 words) but does not mention specific filtering for embedded instructions.
Audit Metadata