skills/involvex/skills/bun-build/Gen Agent Trust Hub

bun-build

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill demonstrates the use of Bun's shell API ($) to execute build-related commands, such as running the TypeScript compiler (bunx tsc). It also uses chmod to set executable permissions on generated CLI tools.
  • Evidence: await $bunx tsc --declaration --emitDeclarationOnly --outDir dist; and await chmod('./dist/cli.js', 0o755);.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes a build pipeline that processes external files (source code, assets, markdown) via custom plugins. This is an inherent property of a build tool, and the skill provides examples of using schema validation (e.g., Zod) to sanitize data.
  • Evidence: references/plugins.md describes plugins that read and transform various file types during the build process.
  • [DYNAMIC_EXECUTION]: The skill facilitates the creation and execution of build scripts using Bun's runtime and native bundling APIs. This behavior is the primary intended purpose of the skill.
  • Evidence: Main workflow involving Bun.build calls and script generation in SKILL.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 05:21 PM