migrate-to-shoehorn

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the @total-typescript/shoehorn package from the npm registry using npm i. This is a well-known utility package for TypeScript testing.
  • [COMMAND_EXECUTION]: The workflow involves executing shell commands, specifically npm install for dependency management and grep to search for type assertion patterns ( as [A-Z]) within the project's test files.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes the content of local test files to perform code transformations.
  • Ingestion points: Test files matching *.test.ts and *.spec.ts are read and processed by the agent.
  • Boundary markers: No specific boundary markers or instructions to ignore embedded prompts in the data are provided in the skill instructions.
  • Capability inventory: The agent has the capability to install packages (npm install), read local files (grep), and presumably modify them to complete the migration.
  • Sanitization: No specific sanitization or validation of the test file content is mentioned before the agent acts upon it.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 06:28 AM
Security Audit — agent-trust-hub — migrate-to-shoehorn