migrate-to-shoehorn

Pass

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing the @total-typescript/shoehorn package via npm. This is a legitimate utility library in the TypeScript ecosystem used for creating test data.
  • [COMMAND_EXECUTION]: The skill instructions include using npm install for dependency management and grep to identify code patterns within specific test files. These are standard operations for a refactoring tool.
  • [PROMPT_INJECTION]: The skill ingests code from local test files, which constitutes an indirect prompt injection surface. The risk is mitigated by the narrow scope of the skill's operations.
  • Ingestion points: Reads local files matching *.test.ts or *.spec.ts using grep.
  • Boundary markers: None provided in the instructions.
  • Capability inventory: File reading, package installation (npm), and file modification.
  • Sanitization: No specific content sanitization or filtering is implemented.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 12, 2026, 11:10 AM
Security Audit — agent-trust-hub — migrate-to-shoehorn