migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides instructions for a standard code refactoring task using legitimate development tools and libraries. No malicious patterns or security risks were detected in the provided code or instructions.
- [EXTERNAL_DOWNLOADS]: The skill recommends installing
@total-typescript/shoehornvia the NPM registry. This is a well-known community utility for TypeScript testing and is considered a safe dependency in a development context. - [COMMAND_EXECUTION]: The skill uses standard shell commands like
npm installandgrepto manage dependencies and identify code patterns for migration. These actions are within the expected behavior of a developer-oriented migration tool. - [INDIRECT_PROMPT_INJECTION]: The skill processes local test files (
.test.ts,.spec.ts) to identify migration targets. While reading external file content is a potential ingestion point for indirect instructions, the skill's specific focus on transforming static code patterns ('as Type' to 'fromPartial()') poses minimal risk. - Ingestion points: Local
.test.tsand.spec.tsfiles identified by thegrepcommand. - Boundary markers: None explicitly mentioned in the instructions.
- Capability inventory: Shell command execution (grep, npm) and file modification via the agent.
- Sanitization: Not applicable, as the skill performs static structural code replacement based on predefined patterns.
Audit Metadata