chore(deps): update pulumi/agent-skills digest to 08a842e

[renovate]

This PR contains the following updates:

Package	Update	Change
pulumi/agent-skills	digest	3ec9d51 → 08a842e

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🛡️ Skill Security Scan Results

✅ package-usage

• Status: Passed
• Findings: 2

✅ provider-upgrade

• Status: Passed
• Findings: 7
• Allowed (not blocking): 2
  • MANIFEST_MISSING_LICENSE (Allowed: pulumi/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)
  • COMPOUND_EXTRACT_EXECUTE (Allowed: The skill documents standard npm install / pip install / go get upgrade workflows which involve extracting packaged archives and running their lifecycle scripts. The scanner itself notes 'found in documentation — may be instructional'.)

✅ pulumi-automation-api

• Status: Passed
• Findings: 2

✅ pulumi-best-practices

• Status: Passed
• Findings: 2
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: pulumi/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ pulumi-component

• Status: Passed
• Findings: 3
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: pulumi/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

❌ pulumi-esc

• Status: Failed
• Findings: 6
• Blocking: 1

Blocking issues:

• [ATR_HIGH_RISK_TOOL_GATE] (HIGH) Pattern detected: Exec (SKILL.md:48)

Allowlisted (not blocking):

• MANIFEST_MISSING_LICENSE (Allowed: pulumi/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ pulumi-upgrade-provider

• Status: Passed
• Findings: 5
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: pulumi/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ upstream-patches

• Status: Passed
• Findings: 3
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: pulumi/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

---

Summary: Scanned 8 skill(s), found 1 blocking issue(s).

⚠️ Action Required: Review the blocking findings. Add a justified entry to the skill's security.allowed_issues[] in its spec.yaml if the finding is a false positive.