inspecting-angular-apps

SUSPICIOUS. The skill’s behavior is largely coherent and locally scoped for Angular runtime debugging, with no credential harvesting or obvious exfiltration. However, it depends on an unverified external CLI/MCP tool (ng-agent) whose official provenance was not established, creating a mandatory high supply-chain risk.