bun
bun is a Developer environment & CLI skill for AI agents, published by carapace-sh in the carapace-bin repository on GitHub. Skillspace rates bun F (45/100) and the safety scan rated it risky; the rating is based on static analysis only.
Risky. This skill has patterns associated with unsafe behaviour. Read the source carefully before running it.
Use when working with the bun CLI — Bun's all-in-one JavaScript runtime and toolkit. Covers the CLI command reference (install, add, remove, run, build, test, x, create, init, pm, upgrade, link, unlink), bunfig.toml configuration, environment variables, the package manager and lockfile, the test runner, the bundler, the Bun runtime API (Bun.serve, Bun.file, Bun.spawn, Bun.write, hashing, transpiler), the Bun shell ($ template literal), module resolution and loaders, and globals. Triggers on: "bun", "bunx", "bun install", "bun add", "bun remove", "bun run", "bun build", "bun test", "bun x", "bun create", "bun init", "bun pm", "bun upgrade", "bun link", "bun unlink", "bunfig.toml", "bun.lock", "Bun.serve", "Bun.file", "Bun.write", "Bun.spawn", "Bun.hash", "Bun.password", "bun:test", "Bun.build", "Bun.Transpiler", "bun shell", "$ template", "import.meta", "JavaScriptCore", "Bun.serve", "HTMLRewriter", "Bun.SQL", "Bun.RedisClient", "Bun.Glob", "Bun.plugin", "bun:ffi".
- Grade
- F
- Quality
- 45 / 100
- Safety
- Risky
- GitHub stars
- 1,891
Unproven: rated by static analysis only, not yet compared head-to-head.
This rating describes the version of the repository we crawled; it may have changed since.
Our review
- Architecture
- 70 / 100
- Maturity
- Structured: ships references or scripts
- Security scan
- High-risk patterns
- License
- MIT
- Adoption
- Adopted by 0 other repositories, in 0 collections
What the scanner flagged
- references sensitive credential env
- executes shell/subprocess
- hidden/zero-width/bidi unicode chars
- mentions secrets in text
Not checked yet
- Category is a classifier prediction; no model has read this skill yet
- Not judged on the rubric yet (not a contender in its category)
- No blind task eval yet
- Scope (portable / vendor / repo-internal) not assessed; only the top of each category is read for scope
- Sibling files (scripts, references) not fetched; security scan covers SKILL.md only
Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.