bun-quickstart
Provides expert guidance for setting up and configuring Bun, including installation, project initialization, and troubleshooting.
Install this skill
Security score
The bun-quickstart skill was audited on Feb 9, 2026 and we found 28 security issues across 4 threat categories, including 2 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 293 | console.log(`Server running at http://localhost:${server.port}`) |
Template literal with variable interpolation in command context
| 349 | console.log(`API running at http://localhost:${server.port}`) |
Piping content to bash shell
| 51 | curl -fsSL https://bun.sh/install | bash |
Piping content to bash shell
| 74 | curl -fsSL https://bun.sh/install | bash |
Curl to non-GitHub URL
| 51 | curl -fsSL https://bun.sh/install | bash |
Curl to non-GitHub URL
| 74 | curl -fsSL https://bun.sh/install | bash |
Fetch to external URL
| 223 | > const data = await fetch("https://api.github.com").then(r => r.json()) |
Access to hidden dotfiles in home directory
| 159 | Create `bunfig.toml` in project root or `~/.bun/bunfig.toml` globally: |
Access to hidden dotfiles in home directory
| 174 | cache = "~/.bun/install/cache" |
Access to hidden dotfiles in home directory
| 403 | echo 'export BUN_INSTALL="$HOME/.bun"' >> ~/.zshrc |
Access to hidden dotfiles in home directory
| 404 | echo 'export PATH="$BUN_INSTALL/bin:$PATH"' >> ~/.zshrc |
Access to hidden dotfiles in home directory
| 405 | source ~/.zshrc |
Access to hidden dotfiles in home directory
| 411 | chmod +x ~/.bun/bin/bun |
Access to .env file
| 252 | ### .env File |
Access to .env file
| 255 | # .env |
Access to .env file
| 264 | const dbUrl = Bun.env.DATABASE_URL |
Access to .env file
| 267 | const apiKey = process.env.API_KEY |
Access to .env file
| 272 | bun --env-file=.env.production run index.ts |
Access to .env file
| 328 | export const sql = postgres(Bun.env.DATABASE_URL!) |
Access to .env file
| 352 | # Run with .env |
Access to .env file
| 475 | 4. **Leverage .env** - Environment-specific config |
External URL reference
| 51 | curl -fsSL https://bun.sh/install | bash |
External URL reference
| 74 | curl -fsSL https://bun.sh/install | bash |
External URL reference
| 171 | registry = "https://registry.npmjs.org" |
External URL reference
| 223 | > const data = await fetch("https://api.github.com").then(r => r.json()) |
External URL reference
| 293 | console.log(`Server running at http://localhost:${server.port}`) |
External URL reference
| 349 | console.log(`API running at http://localhost:${server.port}`) |
External URL reference
| 494 | - For latest updates, check https://bun.sh/docs |