migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
@total-typescript/shoehornpackage via npm. This is a legitimate utility library in the TypeScript ecosystem used for creating test data. - [COMMAND_EXECUTION]: The skill instructions include using
npm installfor dependency management andgrepto identify code patterns within specific test files. These are standard operations for a refactoring tool. - [PROMPT_INJECTION]: The skill ingests code from local test files, which constitutes an indirect prompt injection surface. The risk is mitigated by the narrow scope of the skill's operations.
- Ingestion points: Reads local files matching
*.test.tsor*.spec.tsusinggrep. - Boundary markers: None provided in the instructions.
- Capability inventory: File reading, package installation (
npm), and file modification. - Sanitization: No specific content sanitization or filtering is implemented.
Audit Metadata