The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes an installation command curl -fsSL https://bun.sh/install | bash in SKILL.md. This command downloads and executes an installation script from the Bun project's official domain.
[DYNAMIC_EXECUTION]: The documentation describes advanced runtime features including a built-in C compiler, Foreign Function Interface (FFI) for native library integration, and runtime plugins in references/advanced.md. It also covers system command execution via the Bun Shell ($) and Bun.spawn APIs in references/shell.md and SKILL.md.
[DATA_EXPOSURE]: The skill documents how to access sensitive environment variables and configuration files (e.g., .env) in SKILL.md and references/advanced.md. It also describes an experimental credential store integration, Bun.secrets, for managing local secrets. All credential examples detected use standard placeholders.
[INDIRECT_PROMPT_INJECTION]: The skill defines an environment where untrusted data from network requests (via Bun.serve in references/http-server.md), standard input (via Bun.stdin in references/file-io.md), and file system reads enters the agent context. The capability inventory includes system command execution and file system writes. While the examples do not use explicit boundary markers for untrusted content, the documented Bun Shell ($) utility includes built-in automatic escaping of interpolated variables as a sanitization mechanism.

bun