migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
@total-typescript/shoehornpackage via npm. This is an expected operation for the skill's primary purpose and targets a well-known utility library in the TypeScript ecosystem. - [COMMAND_EXECUTION]: Uses a standard
grepcommand to identify migration targets within the user's project files. The command is scoped to specific file extensions (*.test.ts,*.spec.ts) and targets a static string pattern. - [PROMPT_INJECTION]: As the skill processes and refactors external source code files, it possesses an inherent surface for indirect prompt injection.
- Ingestion points: Reads content from files matching
*.test.tsand*.spec.tsfound via grep. - Boundary markers: None defined in the skill instructions.
- Capability inventory: The skill performs file system modifications and package installations.
- Sanitization: No specific sanitization of the ingested code is described.
Audit Metadata