migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the
@total-typescript/shoehornpackage via npm. This is a well-known utility library used in the TypeScript ecosystem for managing test data types. - [COMMAND_EXECUTION]: The workflow involves executing shell commands such as
npm installfor dependency management andgrepfor identifying target files for migration within the local workspace. - [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by reading and processing the contents of existing project files (
*.test.ts,*.spec.ts) to perform migration tasks. Although this is a necessary function for a migration tool, it involves the ingestion of untrusted data from the codebase. - Ingestion points: Target project files identified via
grepsearches in the workspace (SKILL.md). - Boundary markers: No explicit delimiters or boundary markers are defined for the content extracted from these files.
- Capability inventory: The skill uses file search, package installation, and content replacement capabilities.
- Sanitization: No specific sanitization or validation steps are mentioned for the content retrieved from the test files before processing.
Audit Metadata