rightcode-migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill defines a workflow for processing local source code files, which creates an ingestion surface for indirect prompt injection.
- Ingestion points: Test files (*.test.ts, *.spec.ts) are read by the agent to identify type assertions.
- Boundary markers: There are no explicit instructions or delimiters used to separate the content of external files from the agent's instructions.
- Capability inventory: The skill makes use of shell commands (grep, npm) and provides instructions for the agent to modify local files.
- Sanitization: Content from the files is processed directly without sanitization or escaping.
- [EXTERNAL_DOWNLOADS]: Fetches the @total-typescript/shoehorn package from the npm registry. This is a well-known utility used in the TypeScript ecosystem for type-safe testing and originates from a reputable source.
Audit Metadata