The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents the use of Bun.$ for shell command execution and Bun.spawn for child processes. It includes specific security warnings about shell injection risks and recommends avoiding bash -c in favor of Bun's built-in escaping mechanisms.
[EXTERNAL_DOWNLOADS]: Instructions for using the Bun package manager are provided, including commands to install dependencies from public registries. The skill incorporates security best practices by recommending the --minimum-release-age flag to reduce supply-chain risk and the trustedDependencies configuration to limit the execution of lifecycle scripts.
[REMOTE_CODE_EXECUTION]: The documentation covers Bun Macros, which allow code to be executed at bundle time. It explicitly notes the supply-chain and security implications of this feature and advises on its sparse usage and the ability to disable it for sensitive builds.

bun