Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fellipeutaka/leon/bunnpx skills add fellipeutaka/leon --skill bungit clone --depth 1 https://github.com/fellipeutaka/leonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fellipeutaka/leon/bun)<a href="https://agentmods.dev/skills/fellipeutaka/leon/bun"><img src="https://agentmods.dev/badge/skills/fellipeutaka/leon/bun.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00097 | $0.02760 |
| Opus 5 | $0.00048 | $0.01380 |
| Sonnet 5 | $0.00019 | $0.00552 |
| Haiku 4.5 | $0.00010 | $0.00276 |
Grade C, and why
bun scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://bun.sh/install | bash Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://bun.sh/install | bash Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
const { stdout, exitCode } = Bun.spawnSync(["echo", "hi"]); How it starts
The opening of the file, as written. The whole thing — 395 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bun
Quick Start
# Install
curl -fsSL https://bun.sh/install | bash
# Init project
bun init
# Run TypeScript directly
bun run index.ts
# Watch mode (hard restart on change)
bun --watch index.ts
# Hot reload (preserves global state, no restart)
bun --hot server.ts
Package Management
bun install # install all deps
bun add express # add dependency
bun add -d @types/node # add dev dependency
bun remove lodash # remove
bun update # update all
bun update --latest # ignore semver ranges
bunx prettier --write . # execute package binary (npx equivalent)
bun patch express # patch a dependency in node_modules
Workspaces
// root package.json
{ "workspaces": ["packages/*"] }
// child package.json
{ "dependencies": { "shared": "workspace:*" } }
bun install --filter "pkg-*" # install filtered workspaces
Environment Variables
.env files auto-loaded in order: .env → .env.$(NODE_ENV) → .env.local
Bun.env.API_KEY // Bun-native
process.env.API_KEY // Node.js compat
import.meta.env.API_KEY
bun --env-file=.env.staging run start
HTTP Server
Bun.serve({
port: 3000,
routes: {
"/": new Response("Home"),
"/users/:id": (req) => Response.json({ id: req.params.id }),
"/api/posts": {
GET: () => Response.json([]),
POST: async (req) => Response.json(await req.json(), { status: 201 }),
},
"/api/*": Response.json({ error: "Not found" }, { status: 404 }),
"/favicon.ico": Bun.file("./favicon.ico"),
},
fetch(req) {
return new Response("Not Found", { status: 404 });
},
});
WebSocket Upgrade
Bun.serve({
fetch(req, server) {
if (server.upgrade(req, { data: { userId: "123" } })) return;
return new Response("Not a WebSocket", { status: 400 });
},
websocket: {
open(ws) { ws.subscribe("chat"); },
message(ws, msg) { ws.publish("chat", msg); },
close(ws) {},
},
});
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 395 lines · 97 tokens per session scan C 0cd8671fb74b
bun is a skill published in the GitHub repository fellipeutaka/leon (5 stars, last pushed today), licensed MIT. It adds 97 tokens to every session and 2,760 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it C with 3 findings (downloads and executes remote code, makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
schema-exploration
Lists tables, describes columns and data types, identifies foreign key relationships, and maps entity relationships in a database. Use when the user asks about database schema, table structure, column types, what tables exist, ERD, foreign keys, or how entities relate.
agent-platform-rag-engine-management
Manage and query Agent Platform RAG Engine Corpora and retrieve grounded contexts using the Google GenAI SDK. Use when listing RAG corpora or files, inspecting a corpus, retrieving contexts, or generating content grounded in a RAG corpus. Do not use for standard database queries (use SQL/Spanner skills), Google…
deploy-docker-compose
Run the Omnigent server as a Docker compose stack (server + Postgres) on any Docker host — your laptop, a VPS, EC2 by hand, or as the base layer of any container-platform deploy. Invoke when the user wants to build the image, bring up the compose stack, debug the stack on a host they already have, or extend the stack…
moderator-page-migration
Port a moderator page from the main Next.js app (src/pages/moderator/) into apps/moderator. Use when asked to migrate, move or cut over a /moderator/ page to the spoke, or to port its tRPC procedures and Prisma services to SvelteKit loads/actions and Kysely.
dsql
Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, diagnose cluster performance, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, foreign key…
sql-translate
Translate SQL queries between database dialects (Snowflake, BigQuery, PostgreSQL, MySQL, etc.).