The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents APIs that ingest untrusted data while providing the agent with powerful system capabilities, creating an attack surface for indirect instruction injection.
Ingestion points: Bun.WebView.navigate() processes external URLs in references/webview.md; Bun.markdown.html() parses markdown strings in SKILL.md and references/markdown.md.
Boundary markers: No specific boundary markers or instructions to ignore embedded commands are provided for these data-processing APIs.
Capability inventory: The skill documents access to Bun.spawn and Bun.Terminal for process execution (references/terminal.md), Bun.cron for OS-level persistence (references/cron.md), Bun.SQL and Bun.Redis for database interactions (references/sql.md, references/redis.md), and process.execve for process replacement (SKILL.md).
Sanitization: The documentation explicitly warns that Bun.markdown.html output is not sanitized, allowing raw HTML and javascript: URIs to pass through verbatim (SKILL.md).
[COMMAND_EXECUTION]: The skill documents the use of native APIs for spawning and managing system processes, which can be misused if the agent is directed to execute arbitrary commands.
Evidence: Detailed documentation for Bun.spawn and Bun.Terminal (PTY) in references/terminal.md, and process.execve for replacing the current process in SKILL.md.
[PERSISTENCE]: The skill provides instructions on using Bun.cron to establish scheduled jobs at the operating system level.
Evidence: references/cron.md documents how to register jobs with system schedulers like crontab (Linux), launchd (macOS), and Task Scheduler (Windows).
[DYNAMIC_EXECUTION]: The skill documents APIs for runtime code evaluation and browser-side script execution.
Evidence: Bun.WebView.evaluate() allows executing arbitrary JavaScript strings within the context of the automated browser (references/webview.md).

bun-runtime