skills/involvex/skills/bun-install/Gen Agent Trust Hub

bun-install

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill handles external data in the form of project configuration files, which is an inherent part of package management tasks.\n
  • Ingestion points: The skill processes metadata and dependency lists from package.json, bun.lockb, and bunfig.toml.\n
  • Boundary markers: Absent; the skill does not define specific delimiters to separate untrusted configuration data from the agent's instructions.\n
  • Capability inventory: The skill uses Bash, Read, and Write tools (as specified in SKILL.md) to execute commands and manage project files.\n
  • Sanitization: Absent; no explicit validation of package names or configuration values is performed before they are processed by the CLI tools.\n- [COMMAND_EXECUTION]: The skill provides standard command-line instructions for the Bun CLI to manage packages, workspaces, and environment configurations. These commands are consistent with the skill's primary purpose and leverage the allowed tools.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of dependencies from the public npm registry via bun install. These network operations target a well-known service and are standard for software development workflows.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 05:21 PM