bun-install
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill handles external data in the form of project configuration files, which is an inherent part of package management tasks.\n
- Ingestion points: The skill processes metadata and dependency lists from
package.json,bun.lockb, andbunfig.toml.\n - Boundary markers: Absent; the skill does not define specific delimiters to separate untrusted configuration data from the agent's instructions.\n
- Capability inventory: The skill uses
Bash,Read, andWritetools (as specified inSKILL.md) to execute commands and manage project files.\n - Sanitization: Absent; no explicit validation of package names or configuration values is performed before they are processed by the CLI tools.\n- [COMMAND_EXECUTION]: The skill provides standard command-line instructions for the Bun CLI to manage packages, workspaces, and environment configurations. These commands are consistent with the skill's primary purpose and leverage the allowed tools.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of dependencies from the public npm registry via
bun install. These network operations target a well-known service and are standard for software development workflows.
Audit Metadata