Bun Runtime

Security checks across malware telemetry and agentic risk

Overview

This Bun helper skill is not clearly malicious, but it gives an agent broad shell, filesystem, and network power without meaningful guardrails.

Install only if you intentionally want the agent to have broad local shell, filesystem, and network capabilities through Bun. Use it only in trusted workspaces, review every command, path, URL, and request body before execution, and avoid passing untrusted strings. A safer version would remove eval, avoid building bun -e code from raw inputs, constrain file access to an approved workspace, and require explicit approval for command execution and outbound requests.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The script accepts an arbitrary string argument and executes it with shell eval, which enables unrestricted command execution. This materially exceeds the stated purpose of providing Bun-specific runtime helpers and makes the skill capable of running any shell payload the caller can supply, including destructive filesystem, process, or network actions.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
This is an arbitrary command execution primitive: any input in COMMAND is evaluated by the shell with the privileges of the running process. In the context of an agent skill that may be invoked programmatically, this can be abused to execute destructive commands, exfiltrate secrets, modify files, or establish persistence, making the skill substantially more dangerous than its Bun-helper description suggests.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill documents writing arbitrary paths and automatically creating parent directories without warning about modification of user data. In practice this can overwrite files, create persistence locations, or alter project state unexpectedly, especially when driven by untrusted prompts or indirect instructions.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill openly exposes shell command execution and states it 'runs shell command' without any warning or limitation. In an agent environment, arbitrary command execution is a high-risk capability because it can read secrets, modify files, install persistence, or launch further network activity based on prompt-controlled input.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill documents HTTP requests but does not warn that data may leave the local environment. This is dangerous because agents may include sensitive prompt content, file contents, tokens, or command results in requests to attacker-controlled endpoints without the user recognizing the privacy and security implications.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The script sends arbitrary user-supplied URLs and optional bodies over the network without any warning, confirmation, or policy checks. In an agent skill context, this can cause unintended disclosure of sensitive data, surprise outbound connections, or use as a proxy to contact internal or attacker-controlled endpoints, making the network action materially security-relevant.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script performs shell execution silently and immediately, with no confirmation, warning, or policy gate before running attacker-controlled input. In an agent setting, the absence of a user-facing approval step increases the likelihood of unintended or covert execution of harmful commands.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal