migrate-js-tooling-to-bun
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The reference documentation includes examples of downloading the official Bun installation script from bun.com using curl.\n- [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of the Bun installer and project-specific utility scripts (scripts/compare_lockfiles.py and assets/examples/verify.sh) to perform migration tasks and verify environment integrity.\n- [COMMAND_EXECUTION]: The workflow relies on executing standard package manager commands (bun install, bun test, bun build) to manage project dependencies and build artifacts as intended by its primary purpose.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data which creates an indirect prompt injection attack surface.\n
- Ingestion points: package.json, package-lock.json, and bun.lock files found within the project repository being migrated (SKILL.md, scripts/compare_lockfiles.py).\n
- Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions for the data it processes.\n
- Capability inventory: The environment allows execution of bun, python3, and shell commands (SKILL.md, assets/examples/verify.sh).\n
- Sanitization: The provided Python script parses JSON and applies regular expressions for lockfile normalization but does not perform safety-specific sanitization of the input data.
Audit Metadata