What problem does it solve? Angular's default escaping closes classic XSS, but developers still introduce vulnerabilities through sanitizer bypasses, unsafe token storage, missing CSRF protection, and secrets shipped in the client bundle. This Skill provides a systematic client-side security checklist for hardening or reviewing Angular web features. ## Core Features & Use Cases - XSS and Sanitizer Audit: Detects dangerous bypassSecurityTrust* calls, raw innerHTML assignments, and DOM sinks that skip Angular's sanitizer, with vulnerable vs. safe code patterns. - CSP, CSRF, and Token Storage Guidance: Covers nonce-based Content-Security-Policy, HttpClient XSRF configuration for cookie-authenticated APIs, and httpOnly cookie storage versus localStorage token risks. - Supply Chain and SSR Checks: Runs npm audit --omit=dev for known CVEs and flags SSR/TransferState leaks, open redirects, and secrets compiled into environment.ts. - Use Case: Before shipping a new Angular feature that renders API data and handles login redirects, run this review to catch a bypassSecurityTrustResourceUrl on a query param and an unvalidated returnUrl open redirect. ## Quick Start Review this Angular feature for security issues including XSS, CSRF, token storage, and vulnerable npm packages.
