migrate-to-shoehorn

Pass

Audited by Gen Agent Trust Hub on May 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the @total-typescript/shoehorn package via npm. This is a well-known community library created by a recognized expert in the TypeScript ecosystem.
  • [PROMPT_INJECTION]: Indirect Prompt Injection Surface. Ingestion points: The skill reads content from local files matching *.test.ts, *.spec.ts, and *.test.tsx using Grep and Read tools. Boundary markers: Absent; the skill does not include instructions or delimiters to help the agent distinguish between legitimate source code and potential instructions embedded in code comments or strings. Capability inventory: The agent has access to Bash (for running grep and tsc) and Edit/Write tools to modify files throughout the project. Sanitization: Absent; the skill does not define a process for sanitizing or validating ingested code before the agent processes and acts upon it.
Audit Metadata
Risk Level
SAFE
Analyzed
May 13, 2026, 03:20 PM