bun-workers

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill consists of instructional content and boilerplate code for concurrency patterns in Bun. All demonstrated APIs (Web Workers, worker_threads, Atomics, and SharedArrayBuffer) are used according to standard development practices.
  • [DYNAMIC_EXECUTION]: The skill includes an example of creating a worker via a Blob URL. This is a standard JavaScript pattern for dynamic script execution; in this context, it is used with a static template string for educational purposes and does not incorporate untrusted external input.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides templates for processing data in worker threads (e.g., in the WorkerPool and parallelMap examples). While this creates a surface for data ingestion, the code snippets do not provide the worker with dangerous capabilities like file system access or network operations, limiting the impact of potential injection attacks.
  • Ingestion points: Data passed to worker.postMessage, pool.execute, and parallelMap functions.
  • Boundary markers: None present in the generic templates.
  • Capability inventory: Basic worker lifecycle management (new Worker, postMessage, terminate, MessageChannel).
  • Sanitization: None present in the generic templates.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 12:00 AM
Security Audit — agent-trust-hub — bun-workers