angular-developer
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands using the Angular CLI (
ng) and package managers (npm,npx) for core development tasks including scaffolding, building, testing, and serving applications. - Evidence includes:
ng new,ng build,ng serve,ng test,ng add, andnpm installinstructions inSKILL.mdandreferences/cli.md. - [EXTERNAL_DOWNLOADS]: The skill fetches the Angular CLI and various ecosystem libraries from the npm registry during project initialization and configuration.
- Evidence includes:
npx @angular/cli@latest,npm install @angular/aria, andng add tailwindcss. These target official and well-known packages. - [DYNAMIC_EXECUTION]: The skill employs standard Angular patterns for dynamic code loading and runtime dependency injection.
- Evidence includes: Component lazy loading via
loadComponent: () => import(...)and dynamic dependency creation usinguseFactoryproviders. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes existing project files and codebases, which serves as a potential vector for indirect prompt injection from untrusted source code.
- Ingestion points: Analyzes
package.jsonand project source code inSKILL.mdto determine version-specific best practices. - Boundary markers: The instructions lack explicit delimiters or warnings when processing existing project content.
- Capability inventory: The agent has shell execution capabilities via
ngandnpm, and file system access. - Sanitization: No specific filtering or sanitization of codebase inputs is mentioned.
Audit Metadata