migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project source code files (*.test.ts, *.spec.ts) as input for its migration workflow, which represents a potential attack surface if those files contain malicious instructions. * Ingestion points: Local test files identified through grep and processed for text replacement. * Boundary markers: Absent; there are no instructions to the agent to disregard natural language commands that might be found in code comments or string literals. * Capability inventory: The skill utilizes npm for package installation, grep for file discovery, and performs file modifications. * Sanitization: Absent; the skill does not specify any sanitization or validation for the content of the files it reads.
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the @total-typescript/shoehorn package using npm. This is a reference to a well-known community package on a standard registry.
- [COMMAND_EXECUTION]: The workflow involves executing local shell commands, specifically npm for dependency management and grep for identifying target files for the migration.
Audit Metadata