bun-deploy
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use standard CLI tools including
docker,bun,kubectl, andgitfor building, testing, and deploying applications. These commands are integral to the stated purpose of the skill and align with standard developer workflows. - [EXTERNAL_DOWNLOADS]: The Dockerfile templates and CI/CD configurations reference well-known base images and setup actions from official sources. This includes the
oven/bunDocker image and the official Bun installation script frombun.sh. These resources are standard for the Bun runtime environment. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process project-specific files like
package.jsonandbun.lockbto generate deployment artifacts, which creates a data ingestion surface. - Ingestion points: The skill reads
package.jsonandbun.lockbto determine deployment strategies and generate configurations inSKILL.md. - Boundary markers: No specific delimiters or warnings for embedded instructions are defined for the ingested project files.
- Capability inventory: The skill uses
Bashfor building and testing,Writefor generating Dockerfiles and manifests, andReadfor project analysis. - Sanitization: The skill uses project data to populate templates without explicit sanitization, though this is typical for developer utility tools.
Audit Metadata