ClawHub
Back to skill

Security audit

Bun

Security checks across malware telemetry and agentic risk

Overview

This is a Bun guidance skill with normal developer examples, though one cleanup command can delete local dependency files if copied carelessly.

Safe to install as a Bun reference skill. Before copying cleanup commands, confirm you are in the intended project and have committed or backed up important lockfile changes, because regenerated Bun dependencies may differ from npm or yarn.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This markdown file contains a migration snippet that tells users to run `rm -rf node_modules package-lock.json yarn.lock`, which irreversibly deletes local dependency directories and lockfiles. The surrounding text does not warn that these files will be removed or advise users to confirm backups/clean state first, so the destructive behavior lacks user disclosure.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.