migrate-to-shoehorn

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing the @total-typescript/shoehorn library from the official npm registry. This is a common and legitimate practice for acquiring development utilities.
  • [COMMAND_EXECUTION]: The workflow involves running a grep command to locate specific type assertion patterns within the project's test files. This is a standard, read-only search operation.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it performs searches over user-controlled test files.
  • Ingestion points: Local files with .test.ts or .spec.ts extensions are read using grep as specified in SKILL.md.
  • Boundary markers: Not present.
  • Capability inventory: The skill uses npm install for package management and grep for searching.
  • Sanitization: No specific sanitization or escaping is applied to the content found in test files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 07:48 AM
Security Audit — agent-trust-hub — migrate-to-shoehorn