migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the '@total-typescript/shoehorn' package from the npm registry to support the migration process.
- [COMMAND_EXECUTION]: The skill utilizes shell commands including 'grep' to identify migration targets and 'npx tsc' to verify the integrity of the project after edits.
- [INDIRECT_PROMPT_INJECTION]: The skill contains an indirect prompt injection attack surface as it is designed to ingest and modify untrusted project source code.
- Ingestion points: Reads content from '.test.ts', '.spec.ts', and '*.test.tsx' files (found in SKILL.md).
- Boundary markers: No delimiters or instructions are provided to the agent to ignore potentially malicious instructions embedded in the test files.
- Capability inventory: The skill utilizes Read, Write, Edit, and Bash tools to modify the codebase.
- Sanitization: There is no explicit sanitization or validation of the ingested file content before it is processed by the agent.
Audit Metadata