migrate-to-shoehorn

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the @total-typescript/shoehorn package from the NPM registry. This is a well-known utility library in the TypeScript ecosystem used for creating type-safe partial objects in tests.
  • [COMMAND_EXECUTION]: The skill utilizes the grep command to recursively search for TypeScript type assertions (as Type) within test files. This is a standard and benign use of shell tooling for code analysis.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads and processes the content of local test files (*.test.ts, *.spec.ts). This creates a potential surface for indirect prompt injection if the files being refactored contain malicious instructions, though this is a necessary part of its refactoring functionality.
  • Ingestion points: Local files matched by the grep search in the SKILL.md workflow.
  • Boundary markers: The skill does not explicitly define delimiters for the code it processes.
  • Capability inventory: The skill performs package installation via npm, searches files using grep, and performs text replacement.
  • Sanitization: No specific sanitization or filtering of the ingested file content is mentioned.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 07:56 PM