bun-api
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a technical documentation resource for the Bun runtime. It contains no malicious code, prompt injections, or obfuscated content.
- [INDIRECT_PROMPT_INJECTION]: While the skill documents APIs that handle untrusted data from the network and databases, it emphasizes built-in security features and best practices to prevent exploitation.
- Ingestion points: Data is ingested through APIs such as Bun.serve (HTTP), fetch (network), Bun.sql (databases), Bun.s3 (object storage), Bun.redis (caching), and Bun.WebView (browser automation).
- Boundary markers: The documentation instructs on the use of Bun's tagged template literals (sql and $) to separate untrusted inputs from query and command logic.
- Capability inventory: The skill covers powerful capabilities including file system access, network communication, database manipulation, and shell execution.
- Sanitization: The documentation explicitly highlights Bun's automatic escaping for SQL parameters and shell interpolation, and it warns against manual string concatenation to ensure secure data handling.
Audit Metadata