migrate-to-shoehorn
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
grepto identify specific patterns in TypeScript test files. This is a standard, safe development practice for codebase analysis. - [EXTERNAL_DOWNLOADS]: The skill recommends installing
@total-typescript/shoehornvia npm. This is a legitimate utility library from a well-known source in the TypeScript community. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from local test files.
- Ingestion points: Test files (
*.test.ts,*.spec.ts) read viagrepand for refactoring. - Boundary markers: None explicitly defined for the file content ingestion.
- Capability inventory: File system read/write, package installation (
npm), and pattern searching (grep). - Sanitization: No specific sanitization or escaping of the ingested code content is mentioned.
- [DATA_EXPOSURE_AND_EXFILTRATION]: No patterns of sensitive data access or exfiltration to unauthorized domains were found. The use of npm for package installation is restricted to the specific, legitimate library.
Audit Metadata