bun-development

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow includes downloading and executing installation scripts via curl ... https://bun.sh/install | bash / irm bun.sh/install.ps1 | iex, so at runtime it can ingest outsider-authored free text/code from a public web source into the agent/command execution context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains installation commands that fetch and execute remote scripts (curl -fsSL https://bun.sh/install | bash and powershell -c "irm bun.sh/install.ps1 | iex"), so the URLs https://bun.sh/install and bun.sh/install.ps1 are runtime external dependencies that execute remote code.