Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}".
<textarea id="textarea_{{x.id}}" class="form-control" ng-model="x.option_text" ng-change="record_change(x.id)" rows="3" {{$last?'autofocus':''}}>{{x.option_text}}</textarea>