migrate-js-to-bun
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a secure migration process that avoids automatic trust of external code. It explicitly requires the agent to audit lifecycle scripts and obtain user confirmation before executing 'bun pm trust'.
- [SAFE]: Instructions reinforce credential safety by advising against hardcoding tokens in configuration files and providing grep patterns to detect leaked secrets in .npmrc and bunfig.toml.
- [SAFE]: The provided 'scripts/compare_lockfiles.py' script is a local utility that performs offline analysis of lockfile data. It uses standard libraries and does not perform network operations or access sensitive system files.
- [SAFE]: The workflow prevents dependency confusion attacks by instructing the agent to never move private scopes to the public registry to resolve authentication errors.
Audit Metadata