migrate-to-shoehorn

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill suggests installing the @total-typescript/shoehorn package from the official npm registry, which is a common utility for TypeScript testing environments.
  • [COMMAND_EXECUTION]: The skill workflow requires the agent to execute shell commands, specifically npm install for package management and grep to locate specific code patterns in the project directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill acts on external data by reading and modifying project files found during the search process, creating a potential surface for indirect prompt injection if those files contain malicious instructions.
  • Ingestion points: Project test files (*.test.ts, *.spec.ts) identified by the grep command.
  • Boundary markers: None; the skill assumes the content is valid TypeScript code.
  • Capability inventory: The skill uses shell execution, file reading, and file modification to perform the migration.
  • Sanitization: None; the agent is directed to perform direct code transformations based on structural patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 10:43 AM