migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill suggests installing the
@total-typescript/shoehornpackage from the official npm registry, which is a common utility for TypeScript testing environments. - [COMMAND_EXECUTION]: The skill workflow requires the agent to execute shell commands, specifically
npm installfor package management andgrepto locate specific code patterns in the project directory. - [INDIRECT_PROMPT_INJECTION]: The skill acts on external data by reading and modifying project files found during the search process, creating a potential surface for indirect prompt injection if those files contain malicious instructions.
- Ingestion points: Project test files (
*.test.ts,*.spec.ts) identified by thegrepcommand. - Boundary markers: None; the skill assumes the content is valid TypeScript code.
- Capability inventory: The skill uses shell execution, file reading, and file modification to perform the migration.
- Sanitization: None; the agent is directed to perform direct code transformations based on structural patterns.
Audit Metadata