migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@total-typescript/shoehornpackage via the npm registry. This is a standard dependency for the migration task and originates from a well-known community source. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes the content of local test files (
*.test.ts,*.spec.ts) usinggrep. This represents an indirect prompt injection surface as the agent is exposed to untrusted code content; however, the risk is minimal given the specific refactoring context and the standard nature of source code analysis in development skills. - Ingestion points: Local files matching
*.test.tsor*.spec.tsin the project directory. - Boundary markers: None identified for the file search output.
- Capability inventory: Execution of
npm installand file searching/reading. - Sanitization: Not explicitly mentioned, as the tool relies on pattern matching for syntax replacement.
Audit Metadata