bun-build
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Bun's shell execution API (
$) to invoke the TypeScript compiler (tsc) for generating type declarations inSKILL.md. - [PRIVILEGE_ESCALATION]: In
references/targets.md, the skill provides code to modify file permissions usingchmodto make generated CLI binaries executable. - [EXTERNAL_DOWNLOADS]: The instructions include usage of
bunxto run tools from the npm registry, which involves downloading and executing remote packages. - [INDIRECT_PROMPT_INJECTION]: The skill defines multiple plugin examples in
references/plugins.mdthat read and process file content viaBun.file().text(). While this constitutes a data ingestion surface, it is standard for build tool functionality and lacks malicious triggers. - [SAFE]: All identified behaviors are transparently documented and align with the stated purpose of configuring a production build environment.
Audit Metadata