bun
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides detailed documentation and usage examples for
Bun.$andBun.spawn, which are the runtime's native methods for executing shell commands and managing child processes. - [DYNAMIC_EXECUTION]: Documentation is provided for the
ccanddlopenAPIs within thebun:ffimodule, which facilitate runtime compilation of C source code and interaction with native shared libraries. - [INDIRECT_PROMPT_INJECTION]: The skill describes built-in utilities for parsing and transforming untrusted data, including a Markdown parser (
Bun.markdown) and an HTML streaming rewriter (HTMLRewriter). These represent an attack surface for indirect prompt injection if used to process attacker-controlled content without proper sanitization. - [EXTERNAL_DOWNLOADS]: The documentation covers the use of the Bun package manager (
bun install) and project scaffolding tool (bun create) to fetch dependencies and templates from public registries and version control systems.
Audit Metadata