migrate-bun-toolchain
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project configuration files which could contain embedded instructions intended to influence the agent's behavior.
- Ingestion points: The skill instructions in 'references/migration-decisions.md' require reading 'packageManager' fields, workspace manifests, and lockfiles.
- Boundary markers: There are no defined boundary markers or instructions to treat data from these files as untrusted or to ignore embedded natural language instructions.
- Capability inventory: The skill utilizes powerful CLI tools across multiple files, including 'bun install', 'bun test', 'bun build', and 'bun run' ('references/migration-decisions.md' and 'references/runtime-and-tooling.md').
- Sanitization: No explicit sanitization or strict schema validation of the external project files is mentioned beyond checking for 'compatibility differences'.
Audit Metadata