migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
@total-typescript/shoehornpackage from the npm registry. This is a legitimate vendor resource associated with the author's brand and is necessary for the skill's primary function. - [COMMAND_EXECUTION]: The workflow utilizes
npm installfor dependency management andgrepto identify specific code patterns within the user's codebase. These are standard operations for a development-focused agent skill. - [INDIRECT_PROMPT_INJECTION]: The skill performs automated refactoring by reading and modifying local test files.
- Ingestion points: Test files (
*.test.ts,*.spec.ts) located via grep and read by the agent. - Boundary markers: Absent; the skill relies on standard file system access without specific delimiters for untrusted file content.
- Capability inventory: Shell execution for searching and package installation, along with file system write access for performing the code migration.
- Sanitization: Absent; the skill performs direct text replacement based on identified TypeScript assertion patterns.
Audit Metadata