migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@total-typescript/shoehornNode.js package. The installation instructions explicitly include the--ignore-scriptsflag, which prevents the execution of potentially malicious scripts during installation, and the--save-exactflag to pin the version and prevent supply chain attacks through unexpected updates. - [COMMAND_EXECUTION]: The skill utilizes the
grepcommand to identifyasassertions within local test files. This is a standard and safe use of search tools for code migration. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data by reading and refactoring user test files.
- Ingestion points: Test files matching
*.test.tsor*.spec.tsare read to identify migration targets. - Boundary markers: No explicit delimiters are used to separate user code from agent instructions.
- Capability inventory: The agent has the ability to install packages via
npmand modify local source files. - Sanitization: There is no explicit sanitization of the code being read, but the transformations are restricted to specific TypeScript assertion patterns.
Audit Metadata