bun-build
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill demonstrates the use of Bun's shell API (
$) to execute build-related commands, such as running the TypeScript compiler (bunx tsc). It also useschmodto set executable permissions on generated CLI tools. - Evidence:
await $bunx tsc --declaration --emitDeclarationOnly --outDir dist;andawait chmod('./dist/cli.js', 0o755);. - [INDIRECT_PROMPT_INJECTION]: The skill describes a build pipeline that processes external files (source code, assets, markdown) via custom plugins. This is an inherent property of a build tool, and the skill provides examples of using schema validation (e.g., Zod) to sanitize data.
- Evidence:
references/plugins.mddescribes plugins that read and transform various file types during the build process. - [DYNAMIC_EXECUTION]: The skill facilitates the creation and execution of build scripts using Bun's runtime and native bundling APIs. This behavior is the primary intended purpose of the skill.
- Evidence: Main workflow involving
Bun.buildcalls and script generation inSKILL.md.
Audit Metadata