bun-workers
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of instructional content and boilerplate code for concurrency patterns in Bun. All demonstrated APIs (Web Workers, worker_threads, Atomics, and SharedArrayBuffer) are used according to standard development practices.
- [DYNAMIC_EXECUTION]: The skill includes an example of creating a worker via a Blob URL. This is a standard JavaScript pattern for dynamic script execution; in this context, it is used with a static template string for educational purposes and does not incorporate untrusted external input.
- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for processing data in worker threads (e.g., in the
WorkerPoolandparallelMapexamples). While this creates a surface for data ingestion, the code snippets do not provide the worker with dangerous capabilities like file system access or network operations, limiting the impact of potential injection attacks. - Ingestion points: Data passed to
worker.postMessage,pool.execute, andparallelMapfunctions. - Boundary markers: None present in the generic templates.
- Capability inventory: Basic worker lifecycle management (
new Worker,postMessage,terminate,MessageChannel). - Sanitization: None present in the generic templates.
Audit Metadata