angular-developer

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands using the Angular CLI (ng) and package managers (npm, npx) for core development tasks including scaffolding, building, testing, and serving applications.
  • Evidence includes: ng new, ng build, ng serve, ng test, ng add, and npm install instructions in SKILL.md and references/cli.md.
  • [EXTERNAL_DOWNLOADS]: The skill fetches the Angular CLI and various ecosystem libraries from the npm registry during project initialization and configuration.
  • Evidence includes: npx @angular/cli@latest, npm install @angular/aria, and ng add tailwindcss. These target official and well-known packages.
  • [DYNAMIC_EXECUTION]: The skill employs standard Angular patterns for dynamic code loading and runtime dependency injection.
  • Evidence includes: Component lazy loading via loadComponent: () => import(...) and dynamic dependency creation using useFactory providers.
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes existing project files and codebases, which serves as a potential vector for indirect prompt injection from untrusted source code.
  • Ingestion points: Analyzes package.json and project source code in SKILL.md to determine version-specific best practices.
  • Boundary markers: The instructions lack explicit delimiters or warnings when processing existing project content.
  • Capability inventory: The agent has shell execution capabilities via ng and npm, and file system access.
  • Sanitization: No specific filtering or sanitization of codebase inputs is mentioned.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 01:15 AM