migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Installs the
@total-typescript/shoehornpackage from the npm registry, which is a well-known utility library. - [COMMAND_EXECUTION]: Uses the
greputility to scan local project files for specific TypeScript type assertion patterns. - [PROMPT_INJECTION]: The skill processes project test files, creating an indirect prompt injection surface. (1) Ingestion points: Test files (
*.test.ts,*.spec.ts) are read via grep to identify migration targets. (2) Boundary markers: None explicitly defined. (3) Capability inventory: Package installation, shell search, and file system modifications. (4) Sanitization: No specific sanitization of the ingested file content is performed.
Audit Metadata