migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
@total-typescript/shoehornlibrary from the official npm registry. This is a common and legitimate practice for acquiring development utilities. - [COMMAND_EXECUTION]: The workflow involves running a
grepcommand to locate specific type assertion patterns within the project's test files. This is a standard, read-only search operation. - [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it performs searches over user-controlled test files.
- Ingestion points: Local files with
.test.tsor.spec.tsextensions are read usinggrepas specified in SKILL.md. - Boundary markers: Not present.
- Capability inventory: The skill uses
npm installfor package management andgrepfor searching. - Sanitization: No specific sanitization or escaping is applied to the content found in test files.
Audit Metadata