bjornmelin/bun-audit
archive/skills/bun-audit/SKILL.md
Shared Bun audit/remediation router. Use when auditing a repo for Bun-first correctness, explaining findings, listing rules, planning safe fixes, applying low-risk remediations, or validating Bun-related changes.
$ install --global
skillsauthnpx skillsauth add bjornmelin/dev-skills bun-auditInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 21, 2026, 3:07 AM89.5s3 files scanned
SKILL.md
- name:
- bun-audit
- description:
- Shared Bun audit/remediation router. Use when auditing a repo for Bun-first correctness, explaining findings, listing rules, planning safe fixes, applying low-risk remediations, or validating Bun-related changes.
Bun Audit
Use this skill as a thin router over the native codex-dev bun engine. Do not
duplicate rules or remediation logic here; bun-dev owns rule text and
references.
Commands
audit: runcodex-dev --json bun audit --root <repo>.rules list: runcodex-dev --json bun rules list.rules show <rule-id>: runcodex-dev --json bun rules show <rule-id>.fixes plan: runcodex-dev --json bun fixes plan --root <repo>.fixes apply: runcodex-dev --json bun fixes apply --root <repo>.validate plan: runcodex-dev --json bun validate plan --root <repo>.validate run: runcodex-dev --json bun validate run --root <repo> --fail-on warn.benchmark: runcodex-dev --json bun benchmark --root <repo>.
Operating Rules
- Treat
bun-devas the source of truth for rules and reference snapshots. - Use
codex-dev bun ...; it is the sole supported Bun audit and remediation CLI. - Do not run
fixes apply,validate run, orreferences syncin parallel against the same repo or skill root. - Audit cache writes are opt-in with
--write-cache. - Safe fixes write rollback artifacts under external dev-skills state.
- If a fix is risky or ambiguous, stop at
fixes planand surface the tradeoff.
Related Skills
bjornmelin/multi-model-review
development
VerifiedTrustedCommunity
Pre-PR multi-model review, parallel opus and codex exec adversarial lanes, then adversarial verification of merged findings. Read-only. Use before shipping nontrivial diffs.
3SKILL.mdUpdated Jul 23, 2026
bjornmelin/codex-review
tools
VerifiedTrustedCommunity
Independent gpt-5.6 diff review via the Codex CLI, normal or steerable adversarial with JSON findings. Use before shipping nontrivial changes.
3SKILL.mdUpdated Jul 23, 2026
bjornmelin/codex-delegate
development
VerifiedTrustedCommunity
Delegate implementation, investigation, or bulk work to gpt-5.6 codex via pinned codex exec. Use for clear-spec builds, migrations, debugging, or any task MODELS.md routes to codex.
3SKILL.mdUpdated Jul 23, 2026
bjornmelin/pre-mortem
development
VerifiedTrustedCommunity
Adversarial pre-mortem: imagine the plan failed, work backwards to surface risky assumptions + irreversible bets, then harden them. Proactively offer it (after the current request; confirm first) before a hard-to-reverse or one-way-door call (API, schema, framework, a hire), an all-upside plan, or unvalidated assumptions. Also on request.
3SKILL.mdUpdated Jul 22, 2026