bun
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation includes the official installation command which fetches a shell script from the Bun official website and executes it locally using bash.\n- [PERSISTENCE]: The skill provides information on the
Bun.cronAPI, which allows for scheduling tasks that can integrate with operating system persistence tools like crontab, launchd, or Task Scheduler.\n- [INDIRECT_PROMPT_INJECTION]: The skill exposes various methods for reading and processing external data (e.g.,fetch,Bun.file,Bun.SQL). It specifically notes that theBun.markdown.htmlutility does not sanitize generated HTML, which presents a potential injection surface if the resulting content is not properly handled by the agent.\n- [DYNAMIC_EXECUTION]: The documentation covers runtime features for dynamic code handling, including thebun:ffimodule for loading external dynamic libraries and thebun build --compilecommand for creating standalone executable binaries.
Audit Metadata