A registry token written into bunfig.toml goes to everyone who can read the repository, and $`sh -c "convert ${file}"` hands a file name from a request to a real shell: Bun Shell escapes the value for its own parsing, not for the shell you start. And because trustedDependencies replaces Bun's built-in list of trusted packages, one extra entry runs that package's install script on every machine that installs. This skill finds those and the other Bun project mistakes below before you install or deploy, and tells you how to fix each one.

Your agent runs a scanner on bunfig.toml, .npmrc, package.json, bun.lock (and the names of bun.lockb and other lockfiles), and the TypeScript and JavaScript files that use Bun. It follows request data through variables in each file, knows which Bun Shell and SQL forms escape or bind values and which do not, leaves number arithmetic and ? placeholder lists alone, compares trustedDependencies with Bun's own default list, treats $VAR and ${VAR} references as configured, skips comments, tests and node_modules, and never runs bun or your code. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• B01: plain http:// registries, scope registries, package URLs and lockfile URLs (a registry on localhost is fine)
• B02: registry tokens and passwords written in bunfig.toml, .npmrc, package.json scripts, URLs, code or bun.lock
• B03: request data passed to sh -c, bash -c, bun -e, raw interpolation or Bun.spawn with sh -c, or choosing the program to run
• B04: bun:sqlite and sql.unsafe() queries with values put into the SQL text (also SQL built in a variable and grown with +=)

REVIEW (check before release)

• B11: trustedDependencies entries outside Bun's default trusted list, or from git, GitHub, files or URLs (not reported when install scripts are turned off in bunfig.toml or .npmrc)
• B12: bun.lock next to an npm, Yarn or pnpm lockfile
• B13: the binary bun.lockb, or settings that turn off the text lockfile or lockfile saving
• B14: TLS certificate checks turned off (rejectUnauthorized: false, NODE_TLS_REJECT_UNAUTHORIZED=0)
• B15: Bun.serve development mode written into the code, or stack traces sent to clients
• B16: shell commands built from variables, and request data passed as command arguments
• B17: table or column names and other SQL parts taken from variables

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official Bun documentation link for each rule
• A risky and a safe example Bun project (bunfig.toml, package.json, lockfiles and TypeScript), and the real report the scanner produces on the risky one

Limits

It reads each file on its own: request data is followed through variables inside one file, not across modules, and Bun.serve options built in another variable, Dockerfiles, CI files and the NODE_ENV of your deploy are not read. node:child_process and SQL clients other than bun:sqlite and Bun SQL are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 24 files: SKILL.md, the scanner in scripts/ (10 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (13 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.