Is this mixing routine secure ?
This mixing service seems solid overall.

You could improve it in several ways:


Don't shapeshift your mixed BTC into Zcash. Shapeshift uses "transparent addresses" - which means the Zcash transaction is exactly as transparent as a regular bitcoin transaction. This is because Zcash requires upwards of 8GB of ram and approximately a minute of processing time to generate the private transaction - which Shapeshift is obviously unwilling to commit to for every transaction.
Why mix your bitcoin received via xmr.to before mixing it with joinmarket? One additional mix (using joinmarket) should be enough to obfuscate xmr.to's snooping should they attempt to track the Bitcoin that was exchanged for your Monero  (although there are questions about the long-term viability of bitcoin mixers in general). 


You could also argue that the initial mix before you hit shapeshift is unnecessary  if you do not care that Shapeshift knows how you obtained the Bitcoin that you are trading them for Monero. 

Best of luck with your school project!