bun
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading the Bun runtime from its official website and using the oven-sh/setup-bun GitHub Action for CI environments.
- [REMOTE_CODE_EXECUTION]: Documentation includes the standard and official installation method which involves piping a remote shell script from bun.com to the system shell.
- [COMMAND_EXECUTION]: The agent is instructed to use the bun and bunx CLI tools for tasks such as running tests, building executables, and managing dependencies.
- [PROMPT_INJECTION]: The skill identifies ingestion points in local files like package.json and .env, noting a capability inventory that includes shell execution and file writes; however, it specifies that Bun's shell API provides native sanitization via template interpolation to prevent injection.
- [SAFE]: All external resources and commands described in the skill are consistent with the official Bun ecosystem and represent standard, secure development practices.
Audit Metadata