go-bun
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation for the Bun ORM, a well-known Go library. All code samples follow standard security practices for database interaction.
- [EXTERNAL_DOWNLOADS]: The instructions include 'go get' commands for fetching the Bun ORM and its drivers from GitHub. These are standard dependencies for the Go ecosystem and target well-known repositories, posing no security risk in this context.
- [INDIRECT_PROMPT_INJECTION]: The skill documents features for loading external data through SQL migrations and YAML fixtures. This is an expected attack surface for database-related tooling, and the skill provides appropriate guidance to mitigate common risks.
- Ingestion points: SQL migration files (.sql) and YAML fixtures (.yml) loaded via embed.FS.
- Boundary markers: The skill instructs the agent on the structure of these files.
- Capability inventory: Database execution (Exec, Scan) and file system reading (embed.FS).
- Sanitization: The documentation explicitly warns users to use '?' placeholders instead of string concatenation to prevent SQL injection.
Audit Metadata