The Agent Skills Directory

[METADATA_POISONING]: The skill's metadata falsely attributes the author to "Copyright 2026 Google LLC." This is misleading regarding the skill's actual origin and uses a nonsensical future date, which could lead users to misinterpret the skill's official status and reliability.
[INDIRECT_PROMPT_INJECTION]: The skill instructions for project creation use user-provided variables (project name and Angular version) directly in shell commands, such as npx @angular/cli@<requested_version> new <project-name>. There are no instructions for the agent to sanitize or validate these inputs before execution, creating a command injection surface. 1. Ingestion points: User-supplied name and version strings in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Uses npx and ng for shell commands across multiple steps. 4. Sanitization: Absent.
[COMMAND_EXECUTION]: The skill relies on executing system commands for core project tasks, including scaffolding (ng new), build verification (ng build), and dependency management (npm install, ng add).
[EXTERNAL_DOWNLOADS]: The skill facilitates the download and execution of packages from the npm registry using standard tools like npx and npm. These actions target well-known and trusted infrastructure.

angular-developer