migrate-to-shoehorn

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the @total-typescript/shoehorn package via npm. This is a well-known utility library in the TypeScript community.
  • [COMMAND_EXECUTION]: The skill uses standard shell commands including npm install and grep for finding specific code patterns (as [A-Z]) within test files. These commands are localized to the development environment and follow standard refactoring workflows.
  • [INDIRECT_PROMPT_INJECTION]: The skill involves reading and modifying existing project test files. While these files are external inputs, the refactoring logic is limited to structural code changes (replacing assertions with function calls), posing minimal risk of malicious instruction execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 11:17 AM
Security Audit — agent-trust-hub — migrate-to-shoehorn