angular-development
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMMETADATA_POISONINGDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill contains a custom YAML field
context7_trust_score: 8.9and multiple references in the text to a 'Context7 Trust Score'. This is an attempt to authoritatively claim a safety rating for the skill, which is a metadata poisoning pattern designed to influence the assessment of the skill's safety. - [DYNAMIC_EXECUTION]: The
EXAMPLES.mdfile provides a code example for aSafeHtmlPipeusingthis.sanitizer.bypassSecurityTrustHtml(value). This specific Angular function explicitly disables the framework's built-in XSS (Cross-Site Scripting) protections, allowing the execution of arbitrary code if the input is not sanitized, which is a significant dynamic execution risk. - [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for fetching data from external API endpoints (e.g.,
https://api.example.com/users) and processing user input through reactive forms. It lacks instruction or implementation of boundary markers or sanitization logic when interpolating this untrusted data into the application's view, creating a surface for indirect injection attacks.
Audit Metadata