Atlas / Skills / dills122 / angular-usage-lookup

angular-usage-lookupBLOCK

skills/dills122/angular-usage-lookup

Evidence-backed Angular and Nx usage lookup skill for components, selectors, templates and Material APIs. Built for migration planning.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Version
—
Hosts
—
License
MIT
Stars
0
01

Overview

Evidence-backed Angular and Nx usage lookup skill for components, selectors, templates and Material APIs. Built for migration planning.

Read from source at commit 9799b4f1b241OBSERVED · 2026-10-14
Advertisement
02

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: angular-usage-lookup
description: Find and classify usages of Angular components, selectors, directives, pipes, and input/output APIs across Angular CLI workspaces or Nx monorepos. Use for migration inventories and impact analysis, with semantic evidence and explicit coverage gaps. Produces lookup reports; does not perform migrations.
---

# Angular usage lookup

Produce a reviewable inventory anchored to an exact declaration. Prefer the workspace's existing Angular Language Service and TypeScript tooling. This skill includes small local discovery/LSP collection helpers; Angular supplies the semantic engine.

Read [tool routing](references/tool-routing.md) to select and qualify a backend. Use [the report contract](references/report-contract.md) for results. Consult [acceptance cases](references/acceptance-cases.md) when qualifying an integration or diagnosing missing usages.

For large Nx repositories, use [the large-workspace runbook](references/large-workspaces.md) to account for all configs, batch collection, investigate repeated peculiar cases and distinguish measured accuracy from unresolved coverage.

For lazy routes, nested/recursive fragments, portals, dynamic components and legacy/modern control flow, use [rendering paths](references/rendering-paths.md). It includes qualified traps involving renamed lazy bindings and `ngNonBindable`, plus the separate rendering gauntlet command.

For the runnable Angular **21.2.25** integration, read [local collection](references/local-collection.md). Fixtures include mixed legacy/standalone templates and Material dialogs, a generated 54-library/three-app workspace, and bounded directive/pipe/member checks. The helper accepts a declaration file/class, optional explicitly declared member and explicit project manifests. Angular handles templates; an explicit TypeScript backend handles TS-only targets. The skill plans follow-up queries, classification and final reconciliation; the acceptance matrix states remaining limits.

For Angular Material targets, read [Material catalog](references/material-catalog.md). Its optional generator reuses installed TypeScript/Angular metadata readers to produce versioned lookup indexes and family configs. It includes selectors, declared bindings, exports, inheritance/module/host relationships and reviewed programmatic opener rules. Use these to plan and disambiguate queries; catalog entries are not application usages.

## Establish target and scope

1. Resolve the supplied declaration, class name, selector, pipe name, or member to a declaration path and symbol position. Do not derive a selector by converting the class name to kebab case. Selectors can identify several directives; class names can identify unrelated declarations. Resolve ambiguity before combining results.
2. Read metadata and record all selector alternatives, `exportAs`, relevant input/output public aliases, inheritance and host-directive exposure. Bind member queries to their declaring class and public template name. Resolve barrels and import aliases. Keep unproven source-to-package-`.d.ts` mappings visible as identity gaps.
3. Record resolved Angular/core/compiler/language-service, TypeScript, Node and Nx versions where available, plus lockfile and checkout state. Initial qualification target is Angular 21, the newest LTS on 2026-10-13; recheck the official release table when asked for current LTS. Other versions need their own capability check.
4. Enumerate apps, libraries, build/test/story configurations and leaf tsconfigs. Include application code, tests, stories and other consumers by default; label them separately. Record exclusions. Never silently restrict a monorepo scan to affected projects, an open editor project or Nx reverse dependencies. Read target implementation for identity; omit its declaration from consumer counts, but retain recursive self-usage unless excluded by the user.

Lookup is read-only with respect to application sources and dependency/configuration files. Save reports when requested or customary. Use already installed tools; install the isolated helper dependencies only when setup is authorized. Do not upgrade the scanned workspace's packages, enable compiler options in source, run migrations or rename symbols merely to discover usages.

## Qualify the available tools

- Discover actual capabilities. A tool named `find_references` may use only TypeScript or a text index. Require evidence of Angular template support before treating template hits as semantic references.
- Prefer official Angular Language Service through an existing editor/LSP connection. Open a component TS file belonging to each leaf project, wait for analysis, and prove a known template token resolves to the correct class. Check inline/external templates where present. A running process or empty diagnostics list is not a successful coverage check.
- Record configurations actually analyzed. A server can select one default project for a file shared by several configs. If it cannot select or verify the others, mark them unresolved. One successful query does not establish all-project coverage.
- Require every definition returned for a qualifying probe to identify the exact target. Two directives can expose the same public binding on one element; a reference query at that ambiguous token can union unrelated members. Find a uniquely resolved consumer or retain an identity gap before collecting. Later references to a shared binding still need ownership-aware migration classification.
- Use normal TypeScript references for TS paths the Angular connection does not cover. An existing ts-morph wrapper is acceptable for this part, but does not establish template coverage.
- For a dialog used only from code, qualify a real TS reference with the workspace's TypeScript service; do not invent a template occurrence. Preserve the config and `typescript-references` capability with a template-coverage gap. Follow verified barrel aliases through definition lookup
03

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
declared (1 observation(s))
Dependencies
pinned
Secrets in source
none-found

Findings (12)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
scripts/discover.mjs:32
const { stdout } = await exec(process.execPath, [executable, ...args, '--json'], { cwd: workspace,
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.agents/skills/angular-usage-lookup
.agents/skills/angular-usage-lookup
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.codex/skills/angular-usage-lookup
.codex/skills/angular-usage-lookup
Why it matters. link not followed
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
tests/api-shapes.test.mjs:28
await exec(process.execPath, [compiler, '-p', path.join(workspace, 'tsconfig.json'), '--noEmit']);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
tests/cli-entrypoints.test.mjs:23
await assert.rejects(exec(process.execPath, [path.join(base, 'scripts', script), ...args], { timeout: 15000 }), error => {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
tests/gauntlet/qualification.test.mjs:29
const compiled = await exec(process.execPath, [compiler, '-p', path.join(workspace, 'tsconfig.json'), '--noEmit', 'false', '--outDir', path.join(output, 'compiled')], { timeout: 60000, maxBuffer: 4 *
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
tests/lookup.test.mjs:46
await exec(process.execPath, [path.join(root, 'scripts/collect-references.mjs'),
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/gauntlet/followups.mjs:6
import { startTypeScript } from '../../scripts/typescript.mjs';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/gauntlet/followups.mjs:7
import { collect } from '../../scripts/collect-references.mjs';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/gauntlet/qualification.test.mjs:10
import { collect } from '../../scripts/collect-references.mjs';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/gauntlet/qualification.test.mjs:14
const root = fileURLToPath(new URL('../../', import.meta.url));
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/scale/workspace.mjs:6
export const root = fileURLToPath(new URL('../../', import.meta.url));

Gates applied: no_behavioural_pass.

Audited 2026-10-14 · audit v0.4.1 · source sha 9799b4f1b241full audit observations/trust-audit/skill/dills122__angular-usage-lookup.json · Report an issue / request a re-scan
04

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-149799b4f1b241BLOCKD69first audit
05

Questions

What does the angular-usage-lookup skill do?

Evidence-backed Angular and Nx usage lookup skill for components, selectors, templates and Material APIs. Built for migration planning.

Is angular-usage-lookup safe to install?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What can angular-usage-lookup access on my machine?

The audit observed that it runs shell commands. Each of those is consistent with what it says it does. Secrets in the source: none found.

How current is this page?

The grade is for one exact copy of the source (9799b4f1b241), read on 2026-10-14. The repository is watched, and a new audit runs when it changes — this is the first audit.

Advertisement