Angular v22 Iframe Credentialless Security Gate

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs the agent to "Read the exact Angular 22 documentation or changelog entry before making API claims" (SKILL.md:49) and lists external docs that would be fetched at runtime: https://blog.angular.dev/announcing-angular-v22-c52bb83a4664, https://angular.dev/roadmap, and https://github.com/angular/angular/blob/main/CHANGELOG.md, so the agent would rely on remote content to shape its prompts/claims.