Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Migrate To Shoehorn Skill Security Audit

What the author says it does (original text)

Migrate test files from `as` type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace `as` in tests, or needs partial test data.

Independent security check

Security risks found

Files checked
2
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 2
Medium risk

A test-only package is installed as a regular dependency by default

Source references: 4
What we found

The instructions say shoehorn is only for tests, but use `npm i @total-typescript/shoehorn` without a development-dependency flag. Normal npm behavior records it as a production dependency and changes the dependency manifest and lockfile.

Why this matters

A test-only package may become part of production installation or deployment dependencies, increasing dependency exposure and build, audit, and maintenance overhead.

The skill says shoehorn is for test code only, but twice instructs installation with `npm i` and no development-dependency flag. Under normal npm configuration, that records the test tool as a regular dependency and changes the dependency manifest and lockfile; the impact occurs only if the install step is run. A user can ask for a dev-only install and confirmation of the files that will change.

SKILL.md:12In the instructionsOpen original file
**Test code only.** Never use shoehorn in production code.
Show 3 other places
SKILL.md:20In the instructionsOpen original file
## Install```bashnpm i @total-typescript/shoehorn```
SKILL.md:112In the instructionsOpen original file
2. **Install and migrate**:   - [ ] Install: `npm i @total-typescript/shoehorn`   - [ ] Find test files with `as` assertions: `grep -r " as [A-Z]" --include="*.test.ts" --include="*.spec.ts"`   - [ ] Replace `as Type` with `fromPartial()`
SKILL.md:22In the instructionsOpen original file
```bashnpm i @total-typescript/shoehorn```
Medium risk

Broad replacement rules may loosen unintended test data without running tests

Source references: 3
What we found

The workflow finds assertions with a text pattern and then broadly directs replacement of `as Type` and double assertions with functions that accept partial or arbitrary data. Its final verification requires only a type check, not execution of affected tests.

Why this matters

If a matched assertion is not a partial fixture or intentional error-path case, the migration may stop enforcing complete, correct test data. Type checking can still pass while runtime behavior or test validity changes.

The search is reasonably limited to test files, but the following rules broadly replace both assertion forms without requiring semantic review of each occurrence. Because `fromPartial()` permits incomplete data and `fromAny()` permits intentionally invalid data, a misclassified replacement could weaken static checks on test fixtures. The workflow specifies only a type check, not execution of affected tests. A user can require per-occurrence review and relevant test runs.

SKILL.md:101In the instructionsOpen original file
| --------------- | -------------------------------------------------- || `fromPartial()` | Pass partial data that still type-checks           || `fromAny()`     | Pass intentionally wrong data (keeps autocomplete) || `fromExact()`   | Force full object (swap with fromPartial later)    |
Show 2 other places
SKILL.md:114In the instructionsOpen original file
   - [ ] Install: `npm i @total-typescript/shoehorn`   - [ ] Find test files with `as` assertions: `grep -r " as [A-Z]" --include="*.test.ts" --include="*.spec.ts"`   - [ ] Replace `as Type` with `fromPartial()`   - [ ] Replace `as unknown as Type` with `fromAny()`   - [ ] Add imports from `@total-typescript/shoehorn`   - [ ] Run type check to verify
SKILL.md:99In the instructionsOpen original file
| Function        | Use case                                           || --------------- | -------------------------------------------------- || `fromPartial()` | Pass partial data that still type-checks           || `fromAny()`     | Pass intentionally wrong data (keeps autocomplete) || `fromExact()`   | Force full object (swap with fromPartial later)    |
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

The Skill states that shoehorn is only for test code and explicitly says not to use it in production code.

View source
SKILL.md:10In the instructionsOpen original file
`shoehorn` lets you pass partial data in tests while keeping TypeScript happy. It replaces `as` assertions with type-safe alternatives.**Test code only.** Never use shoehorn in production code.

The workflow searches test files for type assertions, replaces ordinary assertions with `fromPartial()`, replaces double assertions with `fromAny()`, and adds imports.

View source
SKILL.md:114In the instructionsOpen original file
   - [ ] Install: `npm i @total-typescript/shoehorn`   - [ ] Find test files with `as` assertions: `grep -r " as [A-Z]" --include="*.test.ts" --include="*.spec.ts"`   - [ ] Replace `as Type` with `fromPartial()`   - [ ] Replace `as unknown as Type` with `fromAny()`   - [ ] Add imports from `@total-typescript/shoehorn`   - [ ] Run type check to verify

`fromAny()` is designated for intentionally wrong data, so it deliberately bypasses normal type constraints on test data.

View source
SKILL.md:99In the instructionsOpen original file
| Function        | Use case                                           || --------------- | -------------------------------------------------- || `fromPartial()` | Pass partial data that still type-checks           || `fromAny()`     | Pass intentionally wrong data (keeps autocomplete) || `fromExact()`   | Force full object (swap with fromPartial later)    |
Start here · InstructionsSKILL.md
migrate-to-shoehorn
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file

Operations mentioned in code and instructions

Run commands
SKILL.md:22In the instructionsOpen original file
```bashnpm i @total-typescript/shoehorn
Lines read
123
File checksum (to compare versions)
c5035b69dd4239efae28019447363b4772b0feb8c703b10ba9ee7b4def8c96a2