node-to-bun
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to perform environment verification and project cleanup. - Evidence: Executes
bun --version,node --version,ls -la,grep,find,rm -f, andgitcommands throughout the migration workflow. - [EXTERNAL_DOWNLOADS]: The migration workflow involves fetching project dependencies from external sources.
- Evidence: The skill performs
bun installto download and install packages from the official npm registry and references theoven-sh/setup-bunGitHub Action for CI/CD setup. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where it ingests and processes untrusted data from the local project environment.
- Ingestion points: The agent is instructed to read
package.json,tsconfig.json, monorepo configuration files, and environment files (.env). - Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the data read from project files.
- Capability inventory: The skill has access to
Bash,Write,Read, andGrep, allowing it to modify the codebase and execute shell commands based on the analyzed content. - Sanitization: No sanitization or validation logic is explicitly defined for the content extracted from project files before it is used to generate reports or update configurations.
Audit Metadata