registry / AI-agent capability abuse / @buntok/core / 2.1.1

@buntok/core@2.1.1

Core HTTP framework for Bun, bring your own structure

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Source establishes explicit user-command mutation of an agent skill, which the supplied policy classifies as warning-only. No automatic installation mutation, covert exfiltration, or other concrete malicious chain was established.

Static reason

One or more suspicious static signals were detected.

Trigger

The user runs buntok init.

Impact

Agents may load the installed framework guidance, and existing customizations to that skill can be replaced.

Mechanism

The CLI copies its bundled skill into the current project's agent skills directory without checking whether the destination file already exists.

AI rationale

Evidence

dist/cli/index.js.agents/skills/buntok-skill/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The explicit init command writes the bundled skill to .agents/skills/buntok-skill/SKILL.md, overwriting an existing file.
Initialization targets the caller's current project directory.
The CLI activates initialization only when the caller selects init.
package.json defines no automatic install lifecycle hook.

Evidence against

The inspected skill contains framework usage guidance; no reviewer manipulation or malicious instructions were identified.
Inspected network and command operations serve framework authentication, email, formatting, and database functions.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 8 file(s), 1023 KB of source, external domains: accounts.google.com, api.github.com, api.mailgun.net, api.resend.com, api.sendgrid.com, appleid.apple.com, biomejs.dev, cdn.jsdelivr.net, github.com, oauth2.googleapis.com, www.googleapis.com

Source & flagged code

4 flagged

dist/cli/index.jsView file

Lines 287-351javascript

287 );

288 if (biomeProc.exitCode === 0) {

289 console.log(

290 "\x1B[90m\u2728 Auto-formatted generated files with Biome\x1B[0m\n"

291 );

292 }

293 }

294 console.log("\x1B[32mGenerated files:\x1B[0m");

295 for (const result of results.sort()) {

296 console.log(` ${result}`);

297 }

298 console.log(`

299\x1B[36mNext steps:\x1B[0m

300 1. Register your controller in src/index.ts:

301 \x1B[32mimport { ${pascalName}Controller } from "./controllers/${entityName}.controller";\x1B[0m

302 \x1B[32mapp.registerController(${pascalName}Controller);\x1B[0m

303 2. Start dev server: \x1B[33mbun run dev\x1B[0m

304`);

305}

306

307// src/cli/commands/db.ts

308import { execSync } from "child_process";

309import { existsSync as existsSync2, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L307

310function detectOrm() {

311 if (existsSync2("prisma/schema.prisma") || existsSync2("prisma/schema.ts")) {

312 return "prisma";

313 }

314 if (existsSync2("drizzle.config.ts") || existsSync2("drizzle.config.js")) {

315 return "drizzle";

316 }

317 if (existsSync2("ormconfig.json") || existsSync2("ormconfig.ts") || existsSync2("ormconfig.js")) {

318 return "typeorm";

319 }

320 if (existsSync2("package.json")) {

321 const pkg = JSON.parse(readFileSync("package.json", "utf-8"));

322 const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };

323 if (allDeps["@prisma/client"] || allDeps["prisma"]) return "prisma";

324 if (allDeps["drizzle-orm"] || allDeps["drizzle-kit"]) return "drizzle";

325 if (allDeps["typeorm"]) return "typeorm";

326 }

327 return null;

328}

329function runCommand(cmd) {

330 console.log(`\x1B[90m$ ${cmd}\x1B[0m`);

331 try {

332 execSync(cmd, { stdio: "inherit", cwd: process.cwd() });

333 } catch {

334 process.exitCode = 1;

335 }

336}

337function prismaCommand(subcommand, args) {

338 const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim();

339 runCommand(cmd);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L331

340}

341function drizzleCommand(subcommand, args) {

342 const commands = {

343 migrate: "drizzle-kit generate",

344 seed: "drizzle-kit seed",

345 reset: "drizzle-kit drop",

346 status: "drizzle-kit check",

347 generate: "drizzle-kit generate",

348 studio: "drizzle-kit studio"

349 };

350 const cmd = `${commands[subcommand] ?? subcommand} ${args.join(" ")}`.trim();

351 runCommand(cmd);

dist/core-exports.cjsView file

Lines 222-262javascript

222 streamAI: () => streamAI,

223 timeAgo: () => timeAgo,

224 timeout: () => timeout,

225 toISOWithTimezone: () => toISOWithTimezone,

226 toTimezoneParts

Source & flagged code

4 flagged · loading source

dist/cli/index.jsView file

307// src/cli/commands/db.ts L308: import { execSync } from "child_process"; L309: import { existsSync as existsSync2, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L307

331try { L332: execSync(cmd, { stdio: "inherit", cwd: process.cwd() }); L333: } catch { ... L337: function prismaCommand(subcommand, args) { L338: const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim(); L339: runCommand(cmd);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L331

dist/core-exports.cjsView file

242module.exports = __toCommonJS(core_exports_exports); L243: var import_zod3 = require("zod"); L244:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Findings

3 High5 Medium5 Low

HighChild Processdist/cli/index.js

HighShell

HighRuntime Package Installdist/cli/index.js

MediumDynamic Requiredist/core-exports.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/core-exports.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @buntok/core@2.1.1.

See all versions of @buntok/core for other recorded verdicts.

Review the evidence and your use of @buntok/core@2.1.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-01 03:40:57.154Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.