How do I install the Bun Add a trusted dependency skill?

Run npx skillmds@latest add jarle/bun-add-a-trusted-dependency in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Bun Add a trusted dependency skill do?

Add a trusted dependency It is listed under Coding & Dev Tools on SkillMD.

Is Bun Add a trusted dependency safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Bun Add a trusted dependency?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Bun Add a trusted dependency free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Bun Add a trusted dependency?

jarle (@jarle) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Bun Add a trusted dependency by jarle

Name: Bun Add a trusted dependency
Author: jarle

File contents

Add a trusted dependency

Unlike other npm clients, Bun does not execute arbitrary lifecycle scripts for installed dependencies, such as postinstall and node-gyp builds. These scripts represent a potential security risk, as they can execute arbitrary code on your machine.

If you are seeing one of the following errors, you are probably trying to use a package that uses postinstall to work properly:

error: could not determine executable to run for package
InvalidExe

To allow Bun to execute lifecycle scripts for a specific package, add the package to trustedDependencies in your package.json file. You can do this automatically by running the command bun pm trust <pkg>.

{
  "name": "my-app",
  "version": "1.0.0",
  "trustedDependencies": ["my-trusted-package"] // [!code ++]
}

Once this is added, run a fresh install. Bun will re-install your dependencies and properly install

rm -rf node_modules
rm bun.lock
bun install

See Docs > Package manager > Trusted dependencies for complete documentation of trusted dependencies.

---name: bun-add-a-trusted-dependencydescription: Add a trusted dependency---# Add a trusted dependencyUnlike other npm clients, Bun does not execute arbitrary lifecycle scripts for installed dependencies, such as `postinstall` and `node-gyp` builds. These scripts represent a potential security risk, as they can execute arbitrary code on your machine.<Note> Bun includes a default allowlist of popular packages containing `postinstall` scripts that are known to be safe. You can see this list [here](https://github.com/oven-sh/bun/blob/main/src/install/default-trusted-dependencies.txt). This default list only applies to packages installed from npm. For packages from other sources (such as `file:`, `link:`, `git:`, or `github:` dependencies), you must explicitly add them to `trustedDependencies`.</Note>***If you are seeing one of the following errors, you are probably trying to use a package that uses `postinstall` to work properly:* `error: could not determine executable to run for package`* `InvalidExe`***To allow Bun to execute lifecycle scripts for a specific package, add the package to `trustedDependencies` in your package.json file. You can do this automatically by running the command `bun pm trust <pkg>`.<Note> Note that this only allows lifecycle scripts for the specific package listed in `trustedDependencies`, *not* the dependencies of that dependency!</Note>```json package.json icon="file-json" theme={"theme":{"light":"github-light","dark":"dracula"}}{ "name": "my-app", "version": "1.0.0", "trustedDependencies": ["my-trusted-package"] // [!code ++]}```***Once this is added, run a fresh install. Bun will re-install your dependencies and properly install```sh terminal icon="terminal" theme={"theme":{"light":"github-light","dark":"dracula"}}rm -rf node_modulesrm bun.lockbun install```***See [Docs > Package manager > Trusted dependencies](/pm/lifecycle) for complete documentation of trusted dependencies.

Frequently asked questions

Bun Add a trusted dependency