[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C2E8S7JNPDMS15W4QWADK0":3,"skill-same:01M6C2E8S7JNPDMS15W4QWADK0":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":54,"ownerHtmlUrl":55,"ownerBlogUrl":56,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M6C2E8S7JNPDMS15W4QWADK0","bun-release-age-gate",null,"Configure Bun's install.minimumReleaseAge gate (7-day default, 10-day high-sensitivity) for JavaScript projects on Bun. Includes Corepack-equivalent version detection and lockfile-caveat warning.","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbun-release-age-gate\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"release","age","gate","bun","bun release age gate","projects","install","version","configure","detection","lockfile","default","sensitivity","javascript","warning","high","for","2026-11-10 10:12:30",false,"---\nnamespace: aiwg\nname: bun-release-age-gate\nplatforms: [all]\ndescription: Configure Bun's install.minimumReleaseAge gate (7-day default, 10-day high-sensitivity) for JavaScript projects on Bun. Includes Corepack-equivalent version detection and lockfile-caveat warning.\n---\n\n# bun-release-age-gate\n\nUse this skill when a user has chosen Bun as their JavaScript runtime\nand package manager and wants release-age-gate hardening parallel to\nwhat `npm-release-age-gate`, `pnpm-release-age-gate`, and\n`yarn-release-age-gate` provide for their respective ecosystems.\n\n## Triggers\n\n- \"bun release age gate\"\n- \"bun minimumReleaseAge\"\n- \"bun supply chain hardening\"\n- \"bun install hardening\"\n\n## Prerequisites\n\n- Bun v1.1.30+ installed (`bun --version`)\n- `package.json` exists at repo root\n- `bunfig.toml` exists (or will be created) — Bun's config file\n\nIf Bun is below v1.1.30, the skill should refuse to proceed:\n`install.minimumReleaseAge` was introduced in v1.1.30 and earlier\nversions silently ignore it.\n\n## Configuration\n\nAdd the gate to `bunfig.toml` at repo root:\n\n```toml\n[install]\n# Refuse dependency versions published less than 7 days ago.\n# Bun interprets the value in SECONDS. 604800 = 7 days; 864000 = 10 days.\n# Defends against newly-published malicious versions.\nminimumReleaseAge = 604800\n\n# Optional: reject git+ and tarball-URL sources during install\n# (Bun's equivalent of pnpm's blockExoticSubdeps — check current\n# version's docs for the exact key name; the API is evolving)\n# safeRegistry = true\n```\n\n## Unit conversion reference\n\nBun uses **seconds** for `install.minimumReleaseAge`:\n\n| Days | Seconds value |\n|---|---|\n| 1 | `86400` |\n| 7 (recommended default) | `604800` |\n| 10 (high-sensitivity profile) | `864000` |\n| 14 | `1209600` |\n| 30 | `2592000` |\n\nThis differs from npm (**days**), pnpm (**minutes**), and Yarn\n(**duration string** like `7d`). Document the unit inline when\ncommitting the config so future readers don't misread it.\n\n## Lockfile caveat\n\nThe gate is checked at resolution time. If `bun.lockb` was generated\nwithout the gate, the gate applies on the NEXT resolution pass — not\nretroactively against the existing lockfile.\n\nTo apply the gate retroactively:\n\n```bash\n# Force re-resolution\nrm bun.lockb\nbun install\n```\n\nThis is destructive to existing pins. Coordinate before running.\n\n## Version detection (Corepack-equivalent)\n\nBun is not currently in the Corepack supported set, but version\npinning is still important. The `packageManager` field in\n`package.json` can pin Bun:\n\n```bash\nnode -p \"require('.\u002Fpackage.json').packageManager\"\n```\n\nIf the value is `bun@\u003Cversion>`, that's the pinned version (CI\nshould use this). If empty, recommend setting it:\n\n```json\n{\n  \"packageManager\": \"bun@1.1.30\"\n}\n```\n\nThe skill should:\n\n1. Confirm pinned version is ≥ v1.1.30 (else flag — gate is silently ignored)\n2. Document the pinned version\n3. If unpinned, suggest pinning before applying the gate\n\n## Override policy\n\nGenuine emergency overrides:\n\n```bash\n# Bypass the gate for a single install (rare)\nbun add \u003Cpkg> --minimum-release-age=0\n```\n\nDocument every override with reason + sunset date.\n\n## CI integration\n\nAdd a verification step to the publish\u002Fbuild workflow:\n\n```yaml\n- name: Verify Bun gate active\n  run: |\n    set -euo pipefail\n    GATE=$(grep -E '^\\s*minimumReleaseAge\\s*=' bunfig.toml | awk -F'=' '{print $2}' | tr -d ' ')\n    if [ -z \"$GATE\" ] || [ \"$GATE\" -lt 604800 ]; then\n      echo \"✗ Bun install.minimumReleaseAge not configured to baseline (≥604800 = 7 days)\"\n      exit 1\n    fi\n    echo \"✓ Bun install.minimumReleaseAge = $GATE seconds\"\n```\n\n## What to inspect during review\n\n- `bunfig.toml` for `[install] minimumReleaseAge`\n- `package.json` `packageManager` field for Bun version pin\n- CI workflow has the verification step above\n- `bun.lockb` was generated AFTER the gate was committed (timestamp check)\n\n## Output format\n\nWhen auditing an existing Bun project, produce a structured report\nat `.aiwg\u002Fsecurity\u002Fworking\u002Fbun-release-age-audit.md`:\n\n```markdown\n# Bun Release-Age Gate Audit\n\n**Bun version**: \u003Cversion>  (Pinned in package.json: yes\u002Fno)\n**Gate active**: yes (604800s) \u002F yes (864000s) \u002F yes (custom: \u003Cvalue>) \u002F no\n\n## Findings\n\n### \u003Cseverity> — \u003Cdescription>\n\n- File: \u003Cpath>\n- Issue: \u003Cwhat's wrong>\n- Fix: \u003Cexact change>\n\n## Clean Checks\n\n- ...\n\n## Recommendations\n\n- ...\n```\n\n## Bun-specific notes\n\nBun's install API is younger than npm\u002Fpnpm\u002FYarn — settings names have\nchanged across versions. The skill should:\n\n- Check the installed Bun version's docs for the canonical setting name\n- If `install.minimumReleaseAge` isn't recognized by the installed\n  version, fall back to checking for older keys (`minReleaseAge`,\n  `releaseAge`) and recommend upgrade\n\nWhen in doubt, run `bun pm --help` and `bun install --help` to\ndiscover the current supported flags.\n\n## See Also\n\n- [`npm-release-age-gate` skill](..\u002Fnpm-release-age-gate\u002FSKILL.md) — npm equivalent\n- [`pnpm-release-age-gate` skill](..\u002Fpnpm-release-age-gate\u002FSKILL.md) — pnpm equivalent\n- [`yarn-release-age-gate` skill](..\u002Fyarn-release-age-gate\u002FSKILL.md) — Yarn equivalent\n- [`npm-supply-chain-audit` skill](..\u002Fnpm-supply-chain-audit\u002FSKILL.md) — companion audit\n- [`supply-chain-hardening-quickstart` skill](..\u002Fsupply-chain-hardening-quickstart\u002FSKILL.md) — orchestrator\n\n## References\n\n- Bun install settings: \u003Chttps:\u002F\u002Fbun.com\u002Fdocs\u002Fruntime\u002Fbunfig#install>\n- Bun `bunfig.toml` reference: \u003Chttps:\u002F\u002Fbun.com\u002Fdocs\u002Fruntime\u002Fbunfig>\n- Bun release notes for `minimumReleaseAge` introduction: check Bun changelog for v1.1.30\n","# bun-release-age-gate\n\nUse this skill when a user has chosen Bun as their JavaScript runtime\nand package manager and wants release-age-gate hardening parallel to\nwhat `npm-release-age-gate`, `pnpm-release-age-gate`, and\n`yarn-release-age-gate` provide for their respective ecosystems.\n\n## Triggers\n\n- \"bun release age gate\"\n- \"bun minimumReleaseAge\"\n- \"bun supply chain hardening\"\n- \"bun install hardening\"\n\n## Prerequisites\n\n- Bun v1.1.30+ installed (`bun --version`)\n- `package.json` exists at repo root\n- `bunfig.toml` exists (or will be created) — Bun's config file\n\nIf Bun is below v1.1.30, the skill should refuse to proceed:\n`install.minimumReleaseAge` was introduced in v1.1.30 and earlier\nversions silently ignore it.\n\n## Configuration\n\nAdd the gate to `bunfig.toml` at repo root:\n\n```toml\n[install]\n# Refuse dependency versions published less than 7 days ago.\n# Bun interprets the value in SECONDS. 604800 = 7 days; 864000 = 10 days.\n# Defends against newly-published malicious versions.\nminimumReleaseAge = 604800\n\n# Optional: reject git+ and tarball-URL sources during install\n# (Bun's equivalent of pnpm's blockExoticSubdeps — check current\n# version's docs for the exact key name; the API is evolving)\n# safeRegistry = true\n```\n\n## Unit conversion reference\n\nBun uses **seconds** for `install.minimumReleaseAge`:\n\n| Days | Seconds value |\n|---|---|\n| 1 | `86400` |\n| 7 (recommended default) | `604800` |\n| 10 (high-sensitivity profile) | `864000` |\n| 14 | `1209600` |\n| 30 | `2592000` |\n\nThis differs from npm (**days**), pnpm (**minutes**), and Yarn\n(**duration string** like `7d`). Document the unit inline when\ncommitting the config so future readers don't misread it.\n\n## Lockfile caveat\n\nThe gate is checked at resolution time. If `bun.lockb` was generated\nwithout the gate, the gate applies on the NEXT resolution pass — not\nretroactively against the existing lockfile.\n\nTo apply the gate retroactively:\n\n```bash\n# Force re-resolution\nrm bun.lockb\nbun install\n```\n\nThis is destructive to existing pins. Coordinate before running.\n\n## Version detection (Corepack-equivalent)\n\nBun is not currently in the Corepack supported set, but version\npinning is still important. The `packageManager` field in\n`package.json` can pin Bun:\n\n```bash\nnode -p \"require('.\u002Fpackage.json').packageManager\"\n```\n\nIf the value is `bun@\u003Cversion>`, that's the pinned version (CI\nshould use this). If empty, recommend setting it:\n\n```json\n{\n  \"packageManager\": \"bun@1.1.30\"\n}\n```\n\nThe skill should:\n\n1. Confirm pinned version is ≥ v1.1.30 (else flag — gate is silently ignored)\n2. Document the pinned version\n3. If unpinned, suggest pinning before applying the gate\n\n## Override policy\n\nGenuine emergency overrides:\n\n```bash\n# Bypass the gate for a single install (rare)\nbun add \u003Cpkg> --minimum-release-age=0\n```\n\nDocument every override with reason + sunset date.\n\n## CI integration\n\nAdd a verification step to the publish\u002Fbuild workflow:\n\n```yaml\n- name: Verify Bun gate active\n  run: |\n    set -euo pipefail\n    GATE=$(grep -E '^\\s*minimumReleaseAge\\s*=' bunfig.toml | awk -F'=' '{print $2}' | tr -d ' ')\n    if [ -z \"$GATE\" ] || [ \"$GATE\" -lt 604800 ]; then\n      echo \"✗ Bun install.minimumReleaseAge not configured to baseline (≥604800 = 7 days)\"\n      exit 1\n    fi\n    echo \"✓ Bun install.minimumReleaseAge = $GATE seconds\"\n```\n\n## What to inspect during review\n\n- `bunfig.toml` for `[install] minimumReleaseAge`\n- `package.json` `packageManager` field for Bun version pin\n- CI workflow has the verification step above\n- `bun.lockb` was generated AFTER the gate was committed (timestamp check)\n\n## Output format\n\nWhen auditing an existing Bun project, produce a structured report\nat `.aiwg\u002Fsecurity\u002Fworking\u002Fbun-release-age-audit.md`:\n\n```markdown\n# Bun Release-Age Gate Audit\n\n**Bun version**: \u003Cversion>  (Pinned in package.json: yes\u002Fno)\n**Gate active**: yes (604800s) \u002F yes (864000s) \u002F yes (custom: \u003Cvalue>) \u002F no\n\n## Findings\n\n### \u003Cseverity> — \u003Cdescription>\n\n- File: \u003Cpath>\n- Issue: \u003Cwhat's wrong>\n- Fix: \u003Cexact change>\n\n## Clean Checks\n\n- ...\n\n## Recommendations\n\n- ...\n```\n\n## Bun-specific notes\n\nBun's install API is younger than npm\u002Fpnpm\u002FYarn — settings names have\nchanged across versions. The skill should:\n\n- Check the installed Bun version's docs for the canonical setting name\n- If `install.minimumReleaseAge` isn't recognized by the installed\n  version, fall back to checking for older keys (`minReleaseAge`,\n  `releaseAge`) and recommend upgrade\n\nWhen in doubt, run `bun pm --help` and `bun install --help` to\ndiscover the current supported flags.\n\n## See Also\n\n- [`npm-release-age-gate` skill](..\u002Fnpm-release-age-gate\u002FSKILL.md) — npm equivalent\n- [`pnpm-release-age-gate` skill](..\u002Fpnpm-release-age-gate\u002FSKILL.md) — pnpm equivalent\n- [`yarn-release-age-gate` skill](..\u002Fyarn-release-age-gate\u002FSKILL.md) — Yarn equivalent\n- [`npm-supply-chain-audit` skill](..\u002Fnpm-supply-chain-audit\u002FSKILL.md) — companion audit\n- [`supply-chain-hardening-quickstart` skill](..\u002Fsupply-chain-hardening-quickstart\u002FSKILL.md) — orchestrator\n\n## References\n\n- Bun install settings: \u003Chttps:\u002F\u002Fbun.com\u002Fdocs\u002Fruntime\u002Fbunfig#install>\n- Bun `bunfig.toml` reference: \u003Chttps:\u002F\u002Fbun.com\u002Fdocs\u002Fruntime\u002Fbunfig>\n- Bun release notes for `minimumReleaseAge` introduction: check Bun changelog for v1.1.30\n",{"name":5,"namespace":46,"platforms":47,"description":7},"aiwg",[48],"all","main","6754967c344ccb087a8de06972f55a41067b291b","agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbun-release-age-gate",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-14 02:10:01",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add jmagly\u002Faiwg --skill bun-release-age-gate",{"tool":65,"command":66},"bunx","bunx skills add jmagly\u002Faiwg --skill bun-release-age-gate",{"tool":68,"command":69},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill bun-release-age-gate","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fbun-release-age-gate\u002FSKILL.md",true,[],[74,102,126,132,139,153],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":81,"publishedAt":41},"01M70QA0BSYJ49EES9V4RE8QH1","host-hardening","Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[80],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101],"host","host hardening","hardening","read","re","recommendations","remediation","plan","port","verification","Bash","access","only","retention","audit","never","firewall","bind","secrets","request",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":112,"publishedAt":41},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[108,111],{"categoryNo":109,"categoryName":110,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[113,114,115,85,116,90,117,118,92,119,82,120,94,121,122,97,98,123,124,125],"exposure analysis","analysis","unknown","credentials","collection","ufw","ports","internet","local","scope","reconstruction","operator","write",{"skillNo":127,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":131,"publishedAt":41},"01M70P8QATMPKA78E4FT5D2TNA","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[130],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[84,82,83,93,85,101,88,87,96,89,90,91,92,100,94,95,86,97,98,99],{"skillNo":133,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":138,"publishedAt":41},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[136,137],{"categoryNo":109,"categoryName":110,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[114,113,97,116,90,117,92,115,82,120,94,121,122,85,98,119,118,123,124,125],{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":146,"publishedAt":41},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[145],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[147,148,149,150,151,152],"fixture skill","fixture","rule","delivery","true","exercise",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":160,"publishedAt":41},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[159],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[161,162,121,163,148],"pi","pi local","duplicate"]