bun-1-4-migration
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/audit_bun14.pyscript executes the hardcoded commandbun --versionto verify the local execution environment. This is a safe operation that does not involve user-controlled input or shell execution. - [EXTERNAL_DOWNLOADS]: The skill provides instructions and a workflow for installing the
@biomejs/biome@2.5.9package. This is a well-known, legitimate development tool in the JavaScript ecosystem, and the installation is performed via the user's package manager (bun). - [SAFE]: The provided Python scripts,
scripts/check.pyandscripts/audit_bun14.py, perform automated validation of the skill's integrity and a read-only audit of target repository configurations (e.g.,package.json, lockfiles, CI configs). These scripts do not perform network operations or access sensitive system paths like SSH keys or cloud credentials. - [SAFE]: The skill implements a structured migration workflow with safety checks, such as verifying dependency graphs before removing legacy lockfiles and marking unavailable evidence as 'UNVERIFIED' if environment constraints prevent full verification.
Audit Metadata