migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include installing the @total-typescript/shoehorn library from the public npm registry. This is a standard dependency for the migration task.
- [COMMAND_EXECUTION]: The skill utilizes the grep command to search for type assertion patterns within local test files. This is a routine operation for code refactoring.
- [PROMPT_INJECTION]: The skill identifies and processes contents of external files to perform code transformations. This creates a surface for indirect prompt injection if those files contain adversarial instructions. Ingestion points: Local test files searched using grep (SKILL.md). Boundary markers: Absent. Capability inventory: Shell command execution and local file modification. Sanitization: Absent.
Audit Metadata