Please use GitHub's private vulnerability reporting instead of opening a public issue.

• plan.mjs reads package.json and your lockfile, and reads package data from your npm registry. It changes nothing. Dependency names from package.json are treated as untrusted: a name that isn't a valid npm name never reaches a URL or a command, and npm runs without a shell.
• guide.mjs downloads Angular's Update Guide data from GitHub and parses it as text. It never runs it.
• smoke.mjs starts your app's dev server on 127.0.0.1 and, if Chrome is installed, opens the page in a temporary headless profile. This runs your app's code, the same as ng serve would.
• The upgrade itself runs ng update and your package manager, which download and run package code, including migrations. That's true of any Angular upgrade.

The skill commits locally on a new branch and never pushes.

ng-hop has no telemetry and no server of its own. It talks only to your npm registry and GitHub. Your agent's own data handling is separate, so check its documentation.