migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@total-typescript/shoehornpackage from the official npm registry. This is a recognized utility library for TypeScript development. - [COMMAND_EXECUTION]: The workflow includes executing
npm ifor package installation andgrepfor searching codebase patterns. These are standard development operations within the skill's stated purpose of code migration. - [INDIRECT_PROMPT_INJECTION]: The skill has the agent process existing test files (
*.test.ts,*.spec.ts). While these files represent external data input, the skill implements a specific refactoring logic to replace type assertions, minimizing the risk of unauthorized instruction execution. - Ingestion points: Test files identified via
grepcommands. - Boundary markers: None explicitly defined for file content.
- Capability inventory: Package installation (
npm), file searching (grep), and code modification. - Sanitization: Standard IDE/Agent file handling is assumed for the refactoring process.
Audit Metadata