migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@total-typescript/shoehornpackage via npm. This is a well-known community library created by a recognized expert in the TypeScript ecosystem. - [PROMPT_INJECTION]: Indirect Prompt Injection Surface. Ingestion points: The skill reads content from local files matching
*.test.ts,*.spec.ts, and*.test.tsxusingGrepandReadtools. Boundary markers: Absent; the skill does not include instructions or delimiters to help the agent distinguish between legitimate source code and potential instructions embedded in code comments or strings. Capability inventory: The agent has access toBash(for runninggrepandtsc) andEdit/Writetools to modify files throughout the project. Sanitization: Absent; the skill does not define a process for sanitizing or validating ingested code before the agent processes and acts upon it.
Audit Metadata