angular-forms

SUSPICIOUS. The deprecated skill is not overtly malicious, but its primary function is to induce transitive installation of another skill via a third-party CLI, extending trust beyond the reviewed content. Because the target repo appears to be the official Angular replacement and no credentials or exfiltration are involved, this is best classified as medium-risk transitive trust rather than malware.