pulumi-terraform-to-pulumi
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies and processes external Terraform HCL configuration and state data to generate equivalent Pulumi programs. This represents an attack surface where malicious instructions hidden in Terraform comments or metadata could influence the generated output. \n
- Ingestion points: Terraform source files (.tf) and state files (.tfstate). \n
- Boundary markers: None identified; the instructions do not specify delimiters to separate untrusted HCL content from agent instructions. \n
- Capability inventory: The skill performs shell command execution (terraform, pulumi), manages project dependencies via package managers (npm, pip, go, dotnet), and creates Pull Requests with generated code. \n
- Sanitization: No explicit sanitization or validation of the input HCL content is mentioned. \n- [COMMAND_EXECUTION]: The skill executes system commands including terraform state pull and pulumi stack import to manage infrastructure state, along with package managers (npm, pip, go, dotnet) to install infrastructure providers. \n- [EXTERNAL_DOWNLOADS]: The skill triggers the download of Pulumi plugins and provider SDKs from official sources and package registries as part of the migration and state translation process.
Audit Metadata