migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill recommends installing the
@total-typescript/shoehornpackage via npm. This is a scoped package from a well-known TypeScript educator and tool provider, consistent with the skill's stated purpose of improving test type safety. - [INDIRECT_PROMPT_INJECTION]: The skill utilizes
grepto scan local test files (*.test.ts,*.spec.ts) for specific code patterns. This creates an attack surface where malicious content within the analyzed files could attempt to influence the agent's migration behavior. - Ingestion points: Test files read by the
grepcommand. - Boundary markers: None specified in the workflow instructions.
- Capability inventory: Shell command execution (
grep,npm install) and file modification instructions. - Sanitization: No content validation or sanitization is mentioned for the data ingested from the code files.
Audit Metadata