bun

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the official Bun installation script (https://bun.sh/install) for macOS/Linux and the PowerShell installer (bun.sh/install.ps1) for Windows. These are legitimate resources provided by the Bun project for software installation.- [COMMAND_EXECUTION]: The reference files contain examples of shell command execution using the Bun.$ API and child process spawning with Bun.spawn(). These examples are educational and include specific sections on security best practices, such as automatic argument escaping to prevent command injection.- [DYNAMIC_EXECUTION]: The skill documents Bun's Foreign Function Interface (FFI) for loading shared libraries (.so, .dylib, .dll). This is presented as a runtime capability for performance optimization and interop with native code.- [INDIRECT_PROMPT_INJECTION]: Reference files (e.g., references/02-http-server.md) describe how to handle external web requests. The documentation consistently recommends safe practices, like using web-standard Request/Response objects and proper body parsing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 10:30 AM
Security Audit — agent-trust-hub — bun