migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
@total-typescript/shoehornpackage from the public npm registry. This is a legitimate, well-known utility library in the TypeScript ecosystem. - [COMMAND_EXECUTION]: The workflow involves executing
grepto search for type assertions in local project files and suggests automated code replacements to migrate patterns. These are standard operations for a code migration tool. - [PROMPT_INJECTION]: Indirect Prompt Injection: The skill identifies an attack surface by processing project files and user-provided paths.
- Ingestion points: The agent reads content from test files (e.g.,
*.test.ts) specified by the user in the 'Gather requirements' step. - Boundary markers: The skill does not explicitly define delimiters or instructions to ignore embedded commands within the files being migrated.
- Capability inventory: The skill performs package installation (
npm install), file searching (grep), and code modification (replacing strings). - Sanitization: No explicit sanitization or validation of the file content is mentioned before processing.
Audit Metadata