allow-bun

SUSPICIOUS. The skill is coherent with its stated purpose, but it materially weakens execution safeguards by pre-approving shell commands and inline eval. Bun provenance is legitimate, yet `bunx`/package execution introduces medium supply-chain risk from npm; overall this is risky autonomy expansion rather than confirmed malware.