igniteui-angular-components
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to download and install several packages from the npm registry, including
igniteui-angular,@infragistics/igniteui-angular,igniteui-angular-charts,igniteui-dockmanager, andigniteui-webcomponents. These are legitimate vendor-owned resources for the igniteui platform. - [REMOTE_CODE_EXECUTION]: Instructions in
SKILL.mdandreferences/mcp-setup.mdguide the execution ofnpx -y igniteui-cli ai-configandnpx -y igniteui-cli mcp. These commands download and execute the vendor's CLI tool directly from the npm registry at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill relies on an external MCP server (
igniteui-cli) to provide component documentation and API references, creating a surface for indirect prompt injection. - Ingestion points: Documentation content retrieved via
get_doc,search_docs, andsearch_apitools is incorporated into the agent's context (specified inSKILL.md). - Boundary markers: The skill does not define specific delimiters or instructions to treat the retrieved documentation as untrusted data.
- Capability inventory: The skill identifies components, reads reference files, and generates Angular code based on the retrieved documentation (specified in
SKILL.md). - Sanitization: No evidence of sanitization or filtering of the external documentation content is present before it is used for code generation.
Audit Metadata