bun-development
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides official installation commands that fetch scripts from bun.sh, the established domain for the Bun runtime.
- [REMOTE_CODE_EXECUTION]: The installation section includes standard commands for the Bun runtime that download and execute scripts via shell pipes (curl piped to bash and PowerShell Invoke-Expression).
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for the agent to initialize projects, add packages, and execute code, which establishes a surface for indirect prompt injection if the agent is directed to process untrusted project data.
- Ingestion points: bun init, bun create, bun add, and bun install commands in SKILL.md.
- Boundary markers: Absent.
- Capability inventory: File system access (Bun.file), network operations (Bun.serve), and command execution (bun run, bun test) are described throughout SKILL.md.
- Sanitization: Absent.
Audit Metadata