angular-signals

SUSPICIOUS: the skill is not malicious, but its sole function is to redirect users to install another remote skill through a third-party CLI. The target repo appears to be the official Angular org and there is no credential theft or exfiltration, so risk is mainly transitive trust and supply-chain exposure rather than malware.