bun
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses authoritative language to override the agent's internal training data and state. It explicitly commands the agent to disregard its knowledge and enforces a strict pre-condition for execution.
- Evidence: "CRITICAL: Your training data for Bun is unreliable.", "you MUST use WebFetch to read the live docs", "Do not proceed without fetching this URL first.", "Never assume an API exists — verify against current docs."
- [INDIRECT_PROMPT_INJECTION]: The skill mandates the ingestion of untrusted data from a remote URL (
https://bun.sh/llms.txt) which is then used as context for code generation. Because the skill highlights powerful capabilities like shell execution and database access, this creates a vulnerability where poisoned documentation could trick the agent into performing harmful actions. - Ingestion points: External content is fetched from
https://bun.sh/llms.txt(SKILL.md). - Boundary markers: None are present to prevent the agent from obeying instructions embedded within the fetched documentation.
- Capability inventory: The skill encourages use of powerful built-in tools including shell scripting (
Bun.$), SQL/PostgreSQL access (Bun.sql), and S3 operations (Bun.s3). - Sanitization: No sanitization or validation of the fetched documentation is mentioned.
Audit Metadata