Skills angular-developer

📦

angular-developer

Name: angular-developer
Author: angular

v1.0 Content revision r1 High Risk ⚙️ External commands⚡ Contains scripts🌐 Network access📁 Filesystem access

Build Modern Angular Applications

Angular projects require version-aware patterns across components, state, forms, routing, testing, and tooling. This skill applies focused Angular guidance and verifies generated work.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "angular-developer" from https://skillstore.io/skills/angular-angular-developer.md and its manifest at https://skillstore.io/api/skills/angular-angular-developer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/angular-angular-developer.md Signed manifest GET /api/skills/angular-angular-developer/manifest Signed lockfile GET /api/skills/angular-angular-developer/lockfile

Test it

Using "angular-developer". Create a customer search feature with server results, loading feedback, and tests.

Expected outcome:

A standalone feature structure aligned with the current workspace.
Signal-based query and result state with typed HTTP access.
Loading, empty, error, and accessible interaction behavior.
Focused service, component, and routing test coverage.

Using "angular-developer". Review this Angular application before migrating from version 18.

Expected outcome:

A version and dependency compatibility assessment.
Prioritized migration stages with affected framework APIs.
Risks for forms, routing, rendering, and third-party libraries.
Verification steps for builds, tests, accessibility, and runtime behavior.

Using "angular-developer". Plan tests for a protected checkout route with async data.

Expected outcome:

Guard and resolver behavior scenarios.
Router harness coverage for allowed, denied, loading, and failed navigation.
Component checks for accessible status and error feedback.

Security Audit

High Risk

v1 • 9/25/2026 Open versioned report

Most static findings are lexical false positives from Markdown, CSS, Angular APIs, and fixed local imports. Six findings remain confirmed because the skill mandates local CLI execution or unpinned npx downloads. The MCP setup adds a high-confidence supply-chain risk by auto-running an unversioned package.

Files scanned

4,830

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

references/mcp.md:23 references/mcp.md:33-35

Unpinned MCP Package Execution

The MCP setup runs npx with automatic confirmation and no package version. A changed upstream package would execute with the host process permissions.

The documented command and configuration explicitly invoke unversioned @angular/cli through npx, while -y suppresses the normal installation confirmation.

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:16

Ruby/shell backtick execution

3. Once you finish generating code, run `ng build` to ensure there are no build errors. If there are

The skill mandates running ng build in the current workspace. Angular builders can execute project-configured third-party code, so this is real command execution.

Medium

SKILL.md:30

Ruby/shell backtick execution

- **IF** the user requests a specific version (e.g., Angular 15), bypass local installations and str

The instruction explicitly requires npx for a requested Angular version. This downloads and executes package code outside the existing dependency lock.

Medium

SKILL.md:31

Ruby/shell backtick execution

- **Command:** `npx @angular/cli@<requested_version> new <project-name>`

This is an executable npx command containing user-selected version and project placeholders. It downloads package code and needs argument validation before execution.

Medium

SKILL.md:37

Ruby/shell backtick execution

- **Command:** `ng new <project-name>`

This instruction runs ng new with a user-derived project name and writes many files. Unsafe shell interpolation could turn an invalid name into command injection.

Medium

SKILL.md:41

Ruby/shell backtick execution

- **IF** no specific version is requested AND the `ng version` command fails (indicating no Angular

The fallback explicitly requires npx to fetch and execute a package when no local CLI exists. The package is not pinned to a reviewed version.

Medium

SKILL.md:42

Ruby/shell backtick execution

- **Command:** `npx @angular/cli@latest new <project-name>`

The command downloads and executes the latest Angular CLI package. Using a moving version without confirmation creates a supply-chain execution risk.

Risk Factors

⚙️ External commands (50)

references/angular-animations.md:155-160 references/angular-aria.md:36-42 references/angular-aria.md:91-97 references/component-styling.md:17-22 references/components.md:15-16 references/components.md:20-27 references/components.md:46-49 references/creating-services.md:60-66 references/define-routes.md:49-52 references/define-routes.md:52-53 references/define-routes.md:53-54 references/define-routes.md:54-57 references/di-fundamentals.md:56-69 references/effects.md:32-41 references/host-elements.md:68-74 references/http-client.md:37-40 references/http-client.md:97-99 references/inputs.md:14-24 references/inputs.md:24-26 references/inputs.md:61-70 references/navigate-to-routes.md:19-24 references/outputs.md:14-27 references/pipes.md:19-25 references/resource.md:25-40 references/signals-overview.md:73-75 SKILL.md:16 SKILL.md:25 SKILL.md:30 SKILL.md:31 SKILL.md:35 SKILL.md:37 SKILL.md:41 SKILL.md:42 SKILL.md:54 SKILL.md:60 SKILL.md:61 SKILL.md:62 SKILL.md:63 SKILL.md:69 SKILL.md:86 SKILL.md:87 SKILL.md:88 SKILL.md:89 SKILL.md:90 SKILL.md:94 SKILL.md:110 SKILL.md:111 SKILL.md:112 SKILL.md:113 SKILL.md:132

⚡ Contains scripts (9)

references/angular-aria.md:493 references/component-harnesses.md:38 references/component-harnesses.md:55 references/loading-strategies.md:27 references/loading-strategies.md:38 references/loading-strategies.md:42 references/loading-strategies.md:54 references/loading-strategies.md:55 references/signal-forms.md:509

🌐 Network access (13)

references/cli.md:51 references/defining-providers.md:22 references/defining-providers.md:40 references/environment-configuration.md:97 references/environment-configuration.md:34 references/environment-configuration.md:41 references/environment-configuration.md:75 references/http-client.md:37 references/http-client.md:44 references/http-client.md:84 references/resource.md:25 SKILL.md:54 SKILL.md:118

📁 Filesystem access (6)

references/data-resolvers.md:12 references/environment-configuration.md:48 references/mcp.md:57 references/mcp.md:57 references/navigate-to-routes.md:27 references/signal-forms.md:534

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/angular-angular-developer/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/angular-angular-developer/security.svg)](https://skillstore.io/skills/angular-angular-developer?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/angular-angular-developer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/angular-angular-developer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/angular-angular-developer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

angular. (2026). angular-developer security audit report (audit version 1) [Author version 1.0]. Skillstore. https://skillstore.io/skills/angular-angular-developer/audits/1

BibTeX citation

@techreport{angular-angular-angular-developer-2026,
  author = {angular},
  title = {angular-developer security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/angular-angular-developer/audits/1},
  note = {Author version 1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "angular-developer security audit report (audit version 1)"
version: "1.0"
type: report
authors:
  - name: "angular"
date-released: "2026-09-25"
url: "https://skillstore.io/skills/angular-angular-developer/audits/1"
identifiers:
  - type: other
    value: "skillstore:angular-angular-developer:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Implement a Product Feature

Create a maintainable Angular feature with components, state, forms, routing, data access, and focused tests.

Modernize an Angular Workspace

Review older patterns and plan version-compatible migrations toward signals, standalone APIs, and current naming conventions.

Strengthen Quality Coverage

Design accessible interactions and reliable unit, harness, router, and end-to-end tests for existing features.

Try These Prompts

Create a Starter Application

Create an Angular application named [name] for [purpose]. Use my installed Angular version and include routing, styling, and one tested feature.

Build a Feature

Implement [feature] in this Angular workspace. Follow existing conventions and include components, typed data access, loading states, errors, and focused tests.

Modernize Existing Code

Review [area] for outdated Angular patterns. Propose a version-compatible migration to signals and standalone APIs, then implement changes with regression tests.

Design an Application Architecture

Design the architecture for [system]. Address routing, state ownership, dependency injection, SSR, accessibility, security boundaries, testing, and staged migration constraints.

Best Practices

Confirm the workspace Angular version before selecting APIs or migration steps.
Match existing architecture and naming conventions unless a migration is explicitly requested.
Verify generated changes with focused tests, a build, and relevant accessibility checks.

Avoid

Do not introduce recent Angular APIs into unsupported project versions.
Do not mix form strategies or state ownership patterns without a documented reason.
Do not treat successful compilation as proof of accessible, secure, or correct behavior.