skills/mgd34msu/goodvibes-gemini/bun/Gen Agent Trust Hub

bun

Pass

Audited by Gen Agent Trust Hub on Mar 29, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The documentation includes the official installation command for Bun, which involves fetching a shell script from https://bun.sh/install and piping it directly to bash. This is the project's recommended installation method from its official domain.\n- [COMMAND_EXECUTION]: The skill documents how to execute system commands using Bun's built-in $ shell utility and the Bun.spawn API, which are standard features of the runtime for automation and scripting.\n- [EXTERNAL_DOWNLOADS]: Examples demonstrate installing various common third-party libraries from the NPM registry, including express, react, and lodash, using Bun's native package manager.\n- [PROMPT_INJECTION]: The skill illustrates a surface for indirect prompt injection where a runtime environment could process external data through powerful APIs.\n
  • Ingestion points: Data can be ingested through the Bun.serve HTTP server (request handling) or by reading files via Bun.file.\n
  • Boundary markers: The provided code examples do not include specific delimiters or directives to ignore instructions embedded in the processed data.\n
  • Capability inventory: The runtime environment possesses capabilities for shell execution ($, Bun.spawn), file writing (Bun.write), and network operations (Bun.serve).\n
  • Sanitization: Basic usage examples do not demonstrate input validation or sanitization, focusing instead on the functional use of the runtime's APIs.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 29, 2026, 07:53 AM