devtu-auto-discover-apis

SUSPICIOUS: The skill's core purpose is coherent, and its explicit install footprint is modest and mostly official. However, it combines untrusted web discovery, code generation, live API validation, and repository/PR actions, with optional bypass of review gates. The main risk is not malware or deceptive install behavior, but high-impact automation and indirect prompt-injection exposure from turning arbitrary external content into code and network actions.