registry / AI-agent capability abuse / @buntok/core / 2.1.3

@buntok/core@2.1.3

Core HTTP framework for Bun, bring your own structure

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Explicit user-command mutation of agent configuration warrants a warning under the supplied policy. The inspected activation gate and absence of install lifecycle hooks do not support a malicious publish block.

Static reason

One or more suspicious static signals were detected.

Trigger

The user runs buntok init.

Impact

Agents that load project skills may consume the installed instructions; existing instructions at that path can be replaced.

Mechanism

The CLI copies the bundled skill into .agents/skills/buntok-skill/SKILL.md without checking whether the destination file already exists.

AI rationale

Evidence

dist/cli/index.jsdist/cli/index.cjs.agents/skills/buntok-skill/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Both CLI builds copy a bundled skill into .agents/skills/buntok-skill/SKILL.md, overwriting an existing file.
The explicit init command activates the skill write in the caller's current project.
package.json has no automatic install lifecycle hooks.

Evidence against

The agent configuration change requires an explicit CLI command.
No concrete exfiltration or covert payload execution was identified.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 8 file(s), 1.21 MB of source, external domains: accounts.google.com, api.github.com, api.mailgun.net, api.resend.com, api.sendgrid.com, appleid.apple.com, cdn.jsdelivr.net, github.com, oauth2.googleapis.com, www.googleapis.com

Source & flagged code

5 flagged

dist/cli/index.jsView file

Lines 319-383javascript

319 );

320 if (biomeProc.exitCode === 0) {

321 console.log(

322 "\x1B[90m\u2728 Auto-formatted generated files with Biome\x1B[0m\n"

323 );

324 }

325 }

326 console.log("\x1B[32mGenerated files:\x1B[0m");

327 for (const result of results.sort()) {

328 console.log(` ${result}`);

329 }

330 console.log(`

331\x1B[36mNext steps:\x1B[0m

332 1. Register your controller in src/index.ts:

333 \x1B[32mimport { ${pascalName}Controller } from "./controllers/${entityName}.controller";\x1B[0m

334 \x1B[32mapp.registerController(${pascalName}Controller);\x1B[0m

335 2. Start dev server: \x1B[33mbun run dev\x1B[0m

336`);

337}

338

339// src/cli/commands/db.ts

340import { execSync } from "child_process";

341import { existsSync as existsSync3, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L339

342function detectOrm() {

343 if (existsSync3("prisma/schema.prisma") || existsSync3("prisma/schema.ts")) {

344 return "prisma";

345 }

346 if (existsSync3("drizzle.config.ts") || existsSync3("drizzle.config.js")) {

347 return "drizzle";

348 }

349 if (existsSync3("ormconfig.json") || existsSync3("ormconfig.ts") || existsSync3("ormconfig.js")) {

350 return "typeorm";

351 }

352 if (existsSync3("package.json")) {

353 const pkg = JSON.parse(readFileSync("package.json", "utf-8"));

354 const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };

355 if (allDeps["@prisma/client"] || allDeps["prisma"]) return "prisma";

356 if (allDeps["drizzle-orm"] || allDeps["drizzle-kit"]) return "drizzle";

357 if (allDeps["typeorm"]) return "typeorm";

358 }

359 return null;

360}

361function runCommand(cmd) {

362 console.log(`\x1B[90m$ ${cmd}\x1B[0m`);

363 try {

364 execSync(cmd, { stdio: "inherit", cwd: process.cwd() });

365 } catch {

366 process.exitCode = 1;

367 }

368}

369function prismaCommand(subcommand, args) {

370 const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim();

371 runCommand(cmd);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L363

372}

373function drizzleCommand(subcommand, args) {

374 const commands = {

375 migrate: "drizzle-kit generate",

376 seed: "drizzle-kit seed",

377 reset: "drizzle-kit drop",

378 status: "drizzle-kit check",

379 generate: "drizzle-kit generate",

380 studio: "drizzle-kit studio"

381 };

382 const cmd = `${commands[subcommand] ?? subcommand} ${args.join(" ")}`.trim();

383 runCommand(cmd);

dist/core-exports.cjsView file

Lines 196-236javascript

196 toISOWithTimezone: () => toISOWithTimezone,

197 toTimezoneParts: () => toTimezoneParts,

198 truncate: () => truncate,

199 ulid: () => ulid,

200 uniq

dist/cli/index.cjsView file

Lines 25-65javascript

25 // "default" to the CommonJS "module.exports" for node compatibility.

26 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

27 mod

28));

Source & flagged code

5 flagged · loading source

dist/cli/index.jsView file

339// src/cli/commands/db.ts L340: import { execSync } from "child_process"; L341: import { existsSync as existsSync3, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L339

363try { L364: execSync(cmd, { stdio: "inherit", cwd: process.cwd() }); L365: } catch { ... L369: function prismaCommand(subcommand, args) { L370: const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim(); L371: runCommand(cmd);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L363

dist/core-exports.cjsView file

216module.exports = __toCommonJS(core_exports_exports); L217: var import_zod4 = require("zod"); L218:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Findings

4 High5 Medium5 Low

HighChild Processdist/cli/index.js

HighShell

HighCross File Remote Execution Contextdist/cli/index.cjs

HighRuntime Package Installdist/cli/index.js

MediumDynamic Requiredist/core-exports.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/core-exports.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @buntok/core@2.1.3.

See all versions of @buntok/core for other recorded verdicts.

Review the evidence and your use of @buntok/core@2.1.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-01 03:39:34.044Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.