How do I install the Pulumi skill?

Run npx skillmds@latest add alivirgo/pulumi in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Pulumi skill do?

Operational skill for agents to manage infrastructure as code with Pulumi - stacks, previews, secrets, providers, and safe up/destroy workflows. It is listed under Coding & Dev Tools on SkillMD.

Is Pulumi safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Pulumi?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Pulumi free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Pulumi?

alivirgo (@alivirgo) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Pulumi by alivirgo — Agent Skill

Name: Pulumi
Author: alivirgo

Pulumi Infrastructure as Code AI Skill Guide

Overview

Pulumi expresses cloud infrastructure as real programs (TypeScript, Python, Go, C#, YAML). State lives in a backend (Pulumi Cloud or self-managed); each stack is an isolated deployment of the same program (e.g. dev, prod). Agents should treat pulumi preview as mandatory before up, and treat stack secrets as first-class - plaintext config for credentials is a defect.

Program (index.ts / __main__.py)
        |
        v
+----------------+     preview/up      +------------------+
| Stack config   | ------------------> | Cloud providers  |
| + secrets      | <------------------ | AWS/GCP/Azure/k8s|
+----------------+     state refresh   +------------------+

When to use

Creating or reviewing Pulumi projects and stack configs
Previewing diffs before applying infrastructure changes
Managing stack secrets, provider credentials, and resource imports
Migrating imperative cloud CLI scripts into durable IaC

Operational directives

Always pulumi stack select (or pass -s) before mutating; confirm with pulumi whoami -v.
Run pulumi preview and summarize create/update/replace/delete counts before pulumi up.
Store secrets with pulumi config set --secret; never commit decrypted values.
Prefer immutable replaces carefully - call out replacements that destroy data (DBs, disks).
Use resource options (protect, retainOnDelete, aliases) for production stateful resources.

Concrete examples

Project bootstrap (TypeScript)

pulumi new aws-typescript -y -n api-infra -s dev
pulumi config set aws:region us-east-1
pulumi config set --secret dbPassword '***'
pulumi preview
pulumi up --yes

Minimal program sketch

import * as aws from "@pulumi/aws";

const bucket = new aws.s3.BucketV2("assets", {
  tags: { service: "api", env: pulumi.getStack() },
});

export const bucketName = bucket.id;

Stack operations

pulumi stack ls
pulumi stack output --json
pulumi refresh --yes
pulumi destroy --yes   # only with explicit user approval

Import existing resource

pulumi import aws:s3/bucketV2:BucketV2 assets my-existing-bucket-name

Change-risk table

Diff type	Risk	Agent action
Create	Low-Medium	Confirm naming/tags/region
Update in-place	Medium	Check security group / IAM blast radius
Replace	High	Call out downtime and data loss
Delete	High	Require explicit user confirmation

Best practices

One stack per environment; share code via Component Resources, not copy-paste.
Enable policy packs / CI previews on PRs; block merge on unexpected deletes.
Pin provider plugin versions in CI for reproducible plans.
Use protect: true on production databases and critical DNS zones.

Limitations

Preview is not a guarantee against provider eventual-consistency races.
Large monorepos may need automation API or ESC for secrets at scale.
Cross-cloud programs still need correct provider credentials per stack.

Related skills

gcloud-cli / azure-cli - imperative ops and auth debugging beside Pulumi
packer - image baking referenced by compute resources
kubernetes - Pulumi k8s provider workloads
vault - external secret backends integrated with stacks

Pulumi

File contents