bun-development
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions for installing the Bun runtime by downloading and executing a shell script from the official well-known domain
bun.sh. The instructions include safety recommendations for the user to manually inspect the script content before execution. - [INDIRECT_PROMPT_INJECTION]: The skill involves the management and execution of third-party packages through commands like
bun installandbunx. These commands ingest external data and scripts which could theoretically contain malicious instructions. However, the guide provides clear operational limits and advises users to review scripts and registry trust, which aligns with standard development best practices. - Ingestion points: Package installation and execution commands (
bun install,bun add,bunx) inreferences/detailed-guide.md. - Boundary markers: The guide explicitly instructs the user to review installation scripts (
cat "$tmpdir/bun-install.sh") and registry trust before execution. - Capability inventory: Subprocess execution via
bash,bun run,bun test, andbunxdefined inreferences/detailed-guide.md. - Sanitization: Manual review steps and operational limits are provided as safety checkpoints.
Audit Metadata