skills/involvex/skills/node-to-bun/Gen Agent Trust Hub

node-to-bun

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform environment verification and project cleanup.
  • Evidence: Executes bun --version, node --version, ls -la, grep, find, rm -f, and git commands throughout the migration workflow.
  • [EXTERNAL_DOWNLOADS]: The migration workflow involves fetching project dependencies from external sources.
  • Evidence: The skill performs bun install to download and install packages from the official npm registry and references the oven-sh/setup-bun GitHub Action for CI/CD setup.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where it ingests and processes untrusted data from the local project environment.
  • Ingestion points: The agent is instructed to read package.json, tsconfig.json, monorepo configuration files, and environment files (.env).
  • Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the data read from project files.
  • Capability inventory: The skill has access to Bash, Write, Read, and Grep, allowing it to modify the codebase and execute shell commands based on the analyzed content.
  • Sanitization: No sanitization or validation logic is explicitly defined for the content extracted from project files before it is used to generate reports or update configurations.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 05:23 PM