bun-shell
Enables powerful shell scripting with Bun, allowing for command execution, subprocess management, and environment variable handling.
Install this skill
Security score
The bun-shell skill was audited on May 12, 2026 and we found 21 security issues across 2 threat categories, including 13 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Direct command execution function call
| 139 | const proc = Bun.spawn(["echo", "Hello World"]); |
Direct command execution function call
| 147 | const proc = Bun.spawn(["node", "script.js"], { |
Direct command execution function call
| 174 | Bun.spawn(["ls"], { stdio: ["inherit", "inherit", "inherit"] }); |
Direct command execution function call
| 177 | Bun.spawn(["ls"], { stdin: "pipe", stdout: "pipe", stderr: "pipe" }); |
Direct command execution function call
| 180 | Bun.spawn(["ls"], { stdout: null, stderr: null }); |
Direct command execution function call
| 183 | Bun.spawn(["ls"], { |
Direct command execution function call
| 192 | const proc = Bun.spawn(["tail", "-f", "log.txt"], { |
Direct command execution function call
| 208 | const result = Bun.spawnSync(["ls", "-la"]); |
Direct command execution function call
| 288 | Bun.spawn(["npm", "run", "lint"]), |
Direct command execution function call
| 289 | Bun.spawn(["npm", "run", "typecheck"]), |
Direct command execution function call
| 290 | Bun.spawn(["npm", "run", "test"]), |
Direct command execution function call
| 302 | const proc = Bun.spawn(["node"], { |
Direct command execution function call
| 314 | const proc = Bun.spawn(["long-running-process"]); |
Template literal with variable interpolation in command context
| 39 | await $`echo "Hello ${name}"`; |
Template literal with variable interpolation in command context
| 40 | await $`ls ${dir}`; |
Template literal with variable interpolation in command context
| 44 | await $`touch ${files}`; |
Template literal with variable interpolation in command context
| 226 | console.log(`Current branch: ${branch.trim()}`); |
Access to .env file
| 111 | await $`echo $MY_VAR`.env({ MY_VAR: "value" }); |
Access to .env file
| 114 | $.env.MY_VAR = "value"; |
Access to .env file
| 118 | await $`env`.env({}); |
Access to .env file
| 151 | ...process.env, |