📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills bun-development
📦
bun-development
Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Build Bun JavaScript Projects Faster
Bun can simplify JavaScript and TypeScript tooling, but teams need a clear workflow before migration. This skill gives practical guidance for setup, packages, testing, bundling, runtime APIs, and Node.js migration.
Supports: Claude Codex Code(CC)
This skill is part of a pack
Install the whole pack to get every skill the task needs, in one command.
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "bun-development" from https://skillstore.io/skills/sickn33-bun-development.md and its manifest at https://skillstore.io/api/skills/sickn33-bun-development/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "bun-development". I need a Bun starter project for a TypeScript API.
Expected outcome:
Project setup steps with recommended scripts, dependency commands, runtime choices, and a first test plan.
Using "bun-development". I want to migrate a Node.js service to Bun.
Expected outcome:
A migration checklist covering scripts, package manager replacement, compatibility issues, Bun-native APIs, and verification steps.
Using "bun-development". I need to bundle a Bun CLI for production.
Expected outcome:
A build plan with target selection, minification, source maps, executable output, and asset handling notes.
Security Audit
Criticalv4 • 7/6/2026 Open versioned report
The audit found no prompt-injection content or hidden data-exfiltration intent in SKILL.md. Most static hits are Markdown fences, sample Bun server handlers, environment variable examples, or documentation links. Confirmed risks are pipe-to-shell install commands and a non-default npm registry example.
1
Files scanned
692
Lines analyzed
4
Review items
0
False positives ignored
Confirmed security concerns (3)
Critical
Pipe to shell pattern
curl -fsSL https://bun.sh/install | bash
The command pipes a remote install script directly into bash. This is a real remote code execution risk if the network, script, or source is compromised.
Critical
Pipe to shell pattern
curl -fsSL https://bun.sh/install | bash
The command pipes a remote install script directly into bash. This is a real remote code execution risk if the network, script, or source is compromised.
High
Non-standard NPM registry
bun add lodash --registry https://registry.npmmirror.com
The example installs from registry.npmmirror.com instead of the default npm registry. Changing registries can introduce dependency confusion and supply-chain trust risk.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
PowerShell invocation
powershell -c "irm bun.sh/install.ps1 | iex"
The Windows install example invokes PowerShell and executes a remote install script through iex. This can run unreviewed code on the user system.
High
Hardcoded URL
bun add lodash --registry https://registry.npmmirror.com
The URL selects a third-party npm mirror with --registry, changing package trust boundaries. This is a real supply-chain exposure even though shown as an example.
Low
Hardcoded URL
curl -fsSL https://bun.sh/install | bash
The URL is used in a curl pipe-to-shell install command, which downloads remote code for execution. The official source lowers malicious intent but not remote execution risk.
Low
Hardcoded URL
curl -fsSL https://bun.sh/install | bash
The URL is used in a curl pipe-to-shell install command, which downloads remote code for execution. The official source lowers malicious intent but not remote execution risk.
Risk Factors
⚙️ External commands (74)
SKILL.md:26-42 SKILL.md:42-61 SKILL.md:61-79 SKILL.md:79-83 SKILL.md:83-103 SKILL.md:103-107 SKILL.md:107-128 SKILL.md:128-136 SKILL.md:136-157 SKILL.md:157-161 SKILL.md:161-172 SKILL.md:172-176 SKILL.md:176-187 SKILL.md:187-191 SKILL.md:191-198 SKILL.md:198-206 SKILL.md:206-223 SKILL.md:223-227 SKILL.md:227-233 SKILL.md:233-237 SKILL.md:237-246 SKILL.md:246-248 SKILL.md:248-251 SKILL.md:251-259 SKILL.md:259-279 SKILL.md:279-283 SKILL.md:283-305 SKILL.md:305-309 SKILL.md:309-310 SKILL.md:310-314 SKILL.md:314-333 SKILL.md:333-334 SKILL.md:334-342 SKILL.md:342-346 SKILL.md:346-352 SKILL.md:358-371 SKILL.md:371-375 SKILL.md:375-389 SKILL.md:389-397 SKILL.md:397-410 SKILL.md:410-414 SKILL.md:414-432 SKILL.md:432-436 SKILL.md:436-470 SKILL.md:470-474 SKILL.md:474-491 SKILL.md:491-499 SKILL.md:499-509 SKILL.md:509-513 SKILL.md:513-542 SKILL.md:542-546 SKILL.md:546-556 SKILL.md:556-564 SKILL.md:564-580 SKILL.md:580-584 SKILL.md:584-598 SKILL.md:598-602 SKILL.md:602-621 SKILL.md:621-629 SKILL.md:629-637 SKILL.md:637-641 SKILL.md:641-656 SKILL.md:656-660 SKILL.md:660-666 SKILL.md:666-674 SKILL.md:674-675 SKILL.md:675-676 SKILL.md:676-677 SKILL.md:677-678 SKILL.md:678-679 SKILL.md:679-680 SKILL.md:680-681 SKILL.md:681-682 SKILL.md:31
🌐 Network access (13)
📁 Filesystem access (1)
🔑 Env variables (9)
Detected Patterns
Pipe to shell pattern×2Non-standard NPM registry
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-bun-development/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-bun-development?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-bun-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-bun-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-bun-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). bun-development security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-bun-development/audits/4BibTeX citation
@techreport{sickn33-sickn33-bun-development-2026,
author = {sickn33},
title = {bun-development security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-bun-development/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "bun-development security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/sickn33-bun-development/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-bun-development:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
78
Spec Compliance
What You Can Build
Start a Bun Frontend Project
Set up a Bun-based React, Vite, or Next.js project with TypeScript defaults and faster package workflows.
Prototype Bun Services
Build Bun HTTP, WebSocket, SQLite, and password hashing prototypes with native runtime APIs.
Plan a Node.js Migration
Map scripts, package management, testing, compatibility checks, and Bun-native replacements before migration.
Try These Prompts
Start a Bun Project
Help me create a new Bun TypeScript project. Include setup steps, basic scripts, and first test commands.
Migrate Node.js Scripts
Review my Node.js package workflow and suggest a Bun migration plan for scripts, dependencies, tests, and lockfiles.
Optimize Runtime APIs
Audit this Bun service design and recommend native APIs for file handling, HTTP routing, WebSockets, SQLite, and password hashing.
Prepare a Production Build
Create a production Bun build checklist covering bundling, executable targets, source maps, environment files, and deployment risks.
Best Practices
- Verify remote installation scripts before running them, especially pipe-to-shell commands.
- Pin package versions and use trusted registries for reproducible dependency installs.
- Run Bun tests and build checks after changing runtime, bundler, or migration settings.
Avoid
- Piping remote scripts directly into a shell without inspection or checksum verification.
- Switching npm registries globally without confirming trust, availability, and package integrity.
- Assuming every Node.js API behaves identically under Bun without testing edge cases.
Frequently Asked Questions
Does this skill install Bun automatically?
No. It provides command examples and guidance. Users decide which commands to run.
Does it support both JavaScript and TypeScript?
Yes. It focuses on Bun workflows for JavaScript, TypeScript, JSX, tests, and bundling.
Can it help migrate from Node.js?
Yes. It covers script replacement, package manager changes, compatibility checks, and Bun-specific alternatives.
Does it cover server development?
Yes. It includes Bun.serve HTTP handlers, WebSocket examples, SQLite usage, and password hashing patterns.
Are the install commands risk-free?
No. Remote install scripts and registry changes require trust checks before execution.
Can it replace official Bun documentation?
No. Use official docs for version-specific behavior and release changes.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
01171b582d636c013315c5e0d969c64f8d9cdff2
Maintenance freshness
7/18/2026
Usage
10 downloads · 206 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-fullstack
82Build Fullstack Apps with Senior Patterns
Teams need consistent setup, architecture, and review guidance for modern web applications. This skill provides scaffolders, workflow references, and quality prompts for React, Next.js, Node.js, GraphQL, and PostgreSQL projects.
Coding & Development View
📦
senior-architect
81Design Scalable Software Architectures
Architecture decisions are hard to compare across web, mobile, backend, and cloud systems. This skill provides structured guides and local scaffold scripts for reports, dependency review, and trade-off documentation.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
playwright-testing
86Build Reliable Playwright Tests
by C0ntr0lledCha0s
Playwright test suites can become flaky, slow, and difficult to maintain. This skill provides practical patterns for locators, fixtures, page objects, debugging, mocking, and configuration.
Coding & Development View
📦
testing
85Build Reliable Test Automation
by 89jobrien
Weak tests slow releases and hide regressions. This skill guides test strategy, TDD, automation, coverage review, and Playwright web checks.
Coding & Development View
📦
starknet-js
83Build Starknet Apps with starknet.js
by internet-court
Starknet integrations require precise provider, account, transaction, and fee handling across several APIs. This skill provides focused starknet.js v9.x patterns for reliable TypeScript applications.
Coding & Development View
📦
vue-best-practices
82Improve Vue 3 Code Quality
by vuejs-ai
Vue projects often collect reactivity, component, and performance mistakes over time. This skill gives targeted Vue 3 guidance for safer patterns and clearer code.
Coding & Development View
📦
react-dev
82Build Type-Safe React Components
by softaworks
React TypeScript work often needs precise event, hook, and route types. This skill provides focused patterns for typed components, React 19 APIs, and routing.
Coding & Development View
📦
testing-patterns
81Plan Reliable Tests Across Your Codebase
by 0xDarkMatter
This skill helps teams choose test strategies, mocks, data fixtures, coverage gates, and CI patterns without mixing test scopes. It gives Claude, Codex, and Claude Code structured guidance for unit, integration, end-to-end, TDD, and pipeline testing.
Coding & Development View