Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add secondsky/claude-skills --skill bun-package-managergit clone --depth 1 https://github.com/secondsky/claude-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/secondsky/claude-skills/bun-package-manager)<a href="https://agentmods.dev/skills/secondsky/claude-skills/bun-package-manager"><img src="https://agentmods.dev/badge/skills/secondsky/claude-skills/bun-package-manager/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/secondsky/claude-skills/bun-package-manager"><img src="https://agentmods.dev/badge/skills/secondsky/claude-skills/bun-package-manager.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.01494 |
| Opus 5 | $0.00019 | $0.00747 |
| Sonnet 5 | $0.00008 | $0.00299 |
| Haiku 4.5 | $0.00004 | $0.00149 |
Grade A, and why
bun-package-manager scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 260 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bun Package Manager
Bun's package manager is a dramatically faster replacement for npm, yarn, and pnpm. Up to 25x faster than npm install.
Quick Start
# Install all dependencies
bun install
# Add packages
bun add react react-dom
bun add -D typescript @types/react
# Remove packages
bun remove lodash
# Update packages
bun update
# Run package binaries
bunx create-next-app
Core Commands
| Command | Description |
|---|---|
bun install |
Install all dependencies |
bun add <pkg> |
Add dependency |
bun add -D <pkg> |
Add dev dependency |
bun add -O <pkg> |
Add optional dependency |
bun add --peer <pkg> |
Add peer dependency |
bun remove <pkg> |
Remove dependency |
bun update [pkg] |
Update dependencies |
bunx <pkg> |
Run package binary |
bun pm cache rm |
Clear cache |
Installation Flags
# Production mode (no devDependencies)
bun install --production
# Frozen lockfile (CI/CD)
bun install --frozen-lockfile
bun ci # shorthand
# Dry run
bun install --dry-run
# Verbose/Silent
bun install --verbose
bun install --silent
# Force reinstall
bun install --force
# Global packages
bun install -g cowsay
Lockfile
Bun uses bun.lock (text-based since v1.2):
# Generate text lockfile
bun install --save-text-lockfile
# Upgrade from binary bun.lockb
bun install --save-text-lockfile --frozen-lockfile --lockfile-only
rm bun.lockb
Workspaces (Monorepos)
{
"name": "my-monorepo",
"workspaces": ["packages/*", "apps/*"]
}
Run commands across workspaces:
# Run in matching packages
bun run --filter 'pkg-*' build
# Run in all workspaces
bun run --filter '*' test
# Install for specific packages
bun install --filter 'pkg-a'
Lifecycle Scripts
Bun does not run lifecycle scripts from dependencies by default (security). Whitelist trusted packages:
{
"trustedDependencies": ["my-trusted-package"]
}
# Skip all lifecycle scripts
bun install --ignore-scripts
# Concurrent scripts
bun install --concurrent-scripts 5
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 260 lines · 38 tokens per session scan A 13d37df8e851
bun-package-manager is a skill published in the GitHub repository secondsky/claude-skills (216 stars, last pushed 2d ago), licensed MIT. It adds 38 tokens to every session and 1,494 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
remember
Record why something is the way it is — a decision and its reasoning, a lesson that cost time, or a standing constraint. Use when the reasoning behind a choice would be expensive to reconstruct later.
bootstrap
Set up chamnan in this repository for the first time — build the architecture index, measure how well the code describes itself, fill in missing file comments, and record a baseline. Run once per repo.
resume
Write down where this stretch of work stopped, so the next session continues instead of restarting. Use at the end of a working session, or when handing the repository to someone else.
milestone
Record a change that reshaped the repository — what moved, why it was worth doing, and which areas it touched. Use after a migration, a rewrite, or a decision that changed how part of the system works.
capture
Write down a procedure worth keeping — a multi-step process, a trap that cost real time, or something that has now come up three times. Use it the moment you finish such a task, while the details are still exact.
promote
Turn a scratch script into a permanent tool this repo keeps. Use when a check, report, or analysis has proved worth running more than once.