The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes two Python scripts, audit_bun_project.py and scan_bun_hotpaths.py, to assist the agent in analyzing a target repository. These scripts are limited to reading file metadata and scanning source code for specific performance-related patterns using regular expressions. No destructive or arbitrary command execution capabilities are present.
[EXTERNAL_DOWNLOADS]: The documentation includes links to official resources such as bun.com, microsoft.com, and tc39.es, as well as academic papers on arXiv. It also suggests well-known performance tools like mitata, bombardier, and oha. All external references are from trusted or well-known technical sources and are used for guidance rather than automated execution.
[INDIRECT_PROMPT_INJECTION]: As the skill is designed to ingest and process data from external repositories, it possesses an attack surface for indirect prompt injection. Evidence chain: 1. Ingestion points: Repository source code and configuration files via diagnostic scripts. 2. Boundary markers: Absent in prompt interpolation instructions. 3. Capability inventory: File system read, report generation, and suggestion of code changes. 4. Sanitization: Absent, though the processing is limited to static analysis. The risk is minimized because the analysis scripts do not execute the ingested content, and the workflow emphasizes human review and validation of all suggested changes.

bun-es2025-typescript7-performance