migrate-to-shoehorn

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the '@total-typescript/shoehorn' package from the npm registry to support the migration process.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands including 'grep' to identify migration targets and 'npx tsc' to verify the integrity of the project after edits.
  • [INDIRECT_PROMPT_INJECTION]: The skill contains an indirect prompt injection attack surface as it is designed to ingest and modify untrusted project source code.
  • Ingestion points: Reads content from '.test.ts', '.spec.ts', and '*.test.tsx' files (found in SKILL.md).
  • Boundary markers: No delimiters or instructions are provided to the agent to ignore potentially malicious instructions embedded in the test files.
  • Capability inventory: The skill utilizes Read, Write, Edit, and Bash tools to modify the codebase.
  • Sanitization: There is no explicit sanitization or validation of the ingested file content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 02:14 PM
Security Audit — agent-trust-hub — migrate-to-shoehorn