migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the @total-typescript/shoehorn package via npm, which is a common utility in the TypeScript development ecosystem.
- [COMMAND_EXECUTION]: It executes npm install to manage dependencies and utilizes grep to search the local filesystem for specific code patterns (as assertions) in test files.
- [PROMPT_INJECTION]: The skill's workflow involves reading and processing external test files, which constitutes a surface for indirect prompt injection.
- Ingestion points: Test files matching the patterns *.test.ts or *.spec.ts as identified in SKILL.md.
- Boundary markers: No specific delimiters or warnings to ignore embedded instructions are provided in the migration workflow.
- Capability inventory: The skill utilizes npm for package installation, grep for file searching, and the agent's core capabilities for file modification.
- Sanitization: The skill does not specify any sanitization or validation logic for the content of the processed test files.
Audit Metadata