migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
@total-typescript/shoehornpackage via npm. This is a well-known utility library in the TypeScript community. - [COMMAND_EXECUTION]: The skill uses standard shell commands including
npm installandgrepfor finding specific code patterns (as [A-Z]) within test files. These commands are localized to the development environment and follow standard refactoring workflows. - [INDIRECT_PROMPT_INJECTION]: The skill involves reading and modifying existing project test files. While these files are external inputs, the refactoring logic is limited to structural code changes (replacing assertions with function calls), posing minimal risk of malicious instruction execution.
Audit Metadata