bun-expert
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Provides documentation and examples for executing system commands via Bun's native APIs, including
Bun.spawn,process.execve, and the Bun shell (Bun.$). The skill includes security notes stating that shell interpolations are automatically escaped to mitigate injection risks. - [EXTERNAL_DOWNLOADS]: References the standard installation command for the Bun runtime which fetches a script from the official
bun.shdomain and pipes it to bash. - [PERSISTENCE]: Documents the
Bun.cronAPI, which allows applications to register scheduled tasks with operating system utilities such as crontab, launchd, or Task Scheduler. - [INDIRECT_PROMPT_INJECTION]: Identifies ingestion points for external data in web servers (
Bun.serve) and image processing (Bun.Image). It inventories runtime capabilities such as file writing and subprocess spawning (references/builtin-apis.md) and provides explicit sanitization advice, such as validating user-controlled paths to prevent arbitrary file access.
Audit Metadata