migrate-to-shoehorn

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the @total-typescript/shoehorn package via the npm registry. This is a standard dependency for the migration task and originates from a well-known community source.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes the content of local test files (*.test.ts, *.spec.ts) using grep. This represents an indirect prompt injection surface as the agent is exposed to untrusted code content; however, the risk is minimal given the specific refactoring context and the standard nature of source code analysis in development skills.
  • Ingestion points: Local files matching *.test.ts or *.spec.ts in the project directory.
  • Boundary markers: None identified for the file search output.
  • Capability inventory: Execution of npm install and file searching/reading.
  • Sanitization: Not explicitly mentioned, as the tool relies on pattern matching for syntax replacement.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 06:57 AM
Security Audit — agent-trust-hub — migrate-to-shoehorn