angular-new-app
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the '@angular/cli' package from the public npm registry. This is a standard operation for acquiring official developer tools from a trusted organization.
- [COMMAND_EXECUTION]: The instructions utilize shell commands such as 'npm install', 'npx ng new', and 'npx ng generate' to manage the application lifecycle. These commands are executed as part of the core functionality for scaffolding and building web applications.
- [PROMPT_INJECTION]:
- The skill metadata attributes authorship to 'Angular Team @ Google', which is a mismatch with the identified author profile. While technically deceptive, this does not pose an immediate security risk as the skill's logic remains confined to official developer tools.
- The skill instructs the agent to ingest output from the Angular CLI's integrated Model Context Protocol (MCP) server ('get_best_practices'). This represents an ingestion point for external data that could influence agent behavior, though the source is the official CLI tool.
- [COMMAND_EXECUTION]: The skill suggests a global package installation ('npm install -g'), which typically requires administrative privileges. The instructions mitigate risk by requiring the agent to ask the user for permission before executing the installation command.
Audit Metadata