migrate-to-shoehorn

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses grep to identify specific patterns in TypeScript test files. This is a standard, safe development practice for codebase analysis.
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing @total-typescript/shoehorn via npm. This is a legitimate utility library from a well-known source in the TypeScript community.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from local test files.
  • Ingestion points: Test files (*.test.ts, *.spec.ts) read via grep and for refactoring.
  • Boundary markers: None explicitly defined for the file content ingestion.
  • Capability inventory: File system read/write, package installation (npm), and pattern searching (grep).
  • Sanitization: No specific sanitization or escaping of the ingested code content is mentioned.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: No patterns of sensitive data access or exfiltration to unauthorized domains were found. The use of npm for package installation is restricted to the specific, legitimate library.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 04:56 PM
Security Audit — agent-trust-hub — migrate-to-shoehorn