bun

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The documentation includes the official installation command which fetches a shell script from the Bun official website and executes it locally using bash.\n- [PERSISTENCE]: The skill provides information on the Bun.cron API, which allows for scheduling tasks that can integrate with operating system persistence tools like crontab, launchd, or Task Scheduler.\n- [INDIRECT_PROMPT_INJECTION]: The skill exposes various methods for reading and processing external data (e.g., fetch, Bun.file, Bun.SQL). It specifically notes that the Bun.markdown.html utility does not sanitize generated HTML, which presents a potential injection surface if the resulting content is not properly handled by the agent.\n- [DYNAMIC_EXECUTION]: The documentation covers runtime features for dynamic code handling, including the bun:ffi module for loading external dynamic libraries and the bun build --compile command for creating standalone executable binaries.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 11:13 AM