migrate-to-shoehorn

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the @total-typescript/shoehorn Node.js package. The installation instructions explicitly include the --ignore-scripts flag, which prevents the execution of potentially malicious scripts during installation, and the --save-exact flag to pin the version and prevent supply chain attacks through unexpected updates.
  • [COMMAND_EXECUTION]: The skill utilizes the grep command to identify as assertions within local test files. This is a standard and safe use of search tools for code migration.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data by reading and refactoring user test files.
  • Ingestion points: Test files matching *.test.ts or *.spec.ts are read to identify migration targets.
  • Boundary markers: No explicit delimiters are used to separate user code from agent instructions.
  • Capability inventory: The agent has the ability to install packages via npm and modify local source files.
  • Sanitization: There is no explicit sanitization of the code being read, but the transformations are restricted to specific TypeScript assertion patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 02:00 AM