migrate-to-shoehorn

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill provides instructions for a standard code refactoring task using legitimate development tools and libraries. No malicious patterns or security risks were detected in the provided code or instructions.
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing @total-typescript/shoehorn via the NPM registry. This is a well-known community utility for TypeScript testing and is considered a safe dependency in a development context.
  • [COMMAND_EXECUTION]: The skill uses standard shell commands like npm install and grep to manage dependencies and identify code patterns for migration. These actions are within the expected behavior of a developer-oriented migration tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes local test files (.test.ts, .spec.ts) to identify migration targets. While reading external file content is a potential ingestion point for indirect instructions, the skill's specific focus on transforming static code patterns ('as Type' to 'fromPartial()') poses minimal risk.
  • Ingestion points: Local .test.ts and .spec.ts files identified by the grep command.
  • Boundary markers: None explicitly mentioned in the instructions.
  • Capability inventory: Shell command execution (grep, npm) and file modification via the agent.
  • Sanitization: Not applicable, as the skill performs static structural code replacement based on predefined patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 02:33 PM