bun-development

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides commands to download and execute installation scripts from Bun's official domain.
  • Example: curl -fsSLo "$tmpdir/bun-install.sh" https://bun.sh/install followed by bash "$tmpdir/bun-install.sh".
  • The instructions include a safety step to review the script content (cat "$tmpdir/bun-install.sh") before execution.
  • Similar patterns are provided for Windows using PowerShell with Invoke-WebRequest and Get-Content for manual review.
  • [COMMAND_EXECUTION]: Instructs the agent on how to use shell commands for environment setup and project management.
  • Commands include brew install, npm install -g, and various bun CLI operations for running, testing, and building code.
  • Uses powershell -ExecutionPolicy Bypass for the Windows installation process.
  • [EXTERNAL_DOWNLOADS]: Facilitates downloading software and dependencies from external sources.
  • Downloads the Bun runtime from the official website (bun.sh).
  • References standard package registries and GitHub repositories for project dependencies.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes processes that involve reading and acting upon external project files, which constitutes a vulnerability surface.
  • Ingestion points: Project initialization (bun init), template creation (bun create), and reading environment variables from .env files in SKILL.md.
  • Boundary markers: Absent; there are no specific delimiters defined to prevent the agent from following instructions embedded in project files or data.
  • Capability inventory: The skill demonstrates file system access (Bun.file, Bun.write), network services (Bun.serve), and command execution (bun run, bunx).
  • Sanitization: No specific sanitization or validation logic is described for handling content within ingested project files or environment variables.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 07:48 AM
Security Audit — agent-trust-hub — bun-development