ngrx-devtool-debugger
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Installs the
@amadeus-it-group/ngrx-devtoolpackage from NPM, a standard development tool dependency. - [COMMAND_EXECUTION]: Uses
npxto launch a local server for state visualization. - [REMOTE_CODE_EXECUTION]: The skill instructs the user to run
npx ngrx-devtoolafter installing a scoped package (@amadeus-it-group/ngrx-devtool). This pattern is a risk asnpxmay download and execute an unrelated unscoped package from the registry if the binary name is not provided by the installed dependency. - [DATA_EXFILTRATION]: Application state is transmitted over WebSockets for monitoring. The skill provides configuration patterns to disable this in production, but misconfiguration could lead to exposure of sensitive data.
- [INDIRECT_PROMPT_INJECTION]: The visualization tool creates a surface for indirect prompt injection by processing store state. • Ingestion points: Store actions and state data. • Boundary markers: None identified. • Capability inventory: No agent-level file or network writing capabilities are present. • Sanitization: No sanitization of the displayed content is described.
Audit Metadata