devtu-create-tool

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). SKILL.md explicitly requires calling and parsing public third‑party APIs (e.g., code examples using requests.get to BASE_URL, mentions of PubMed/NCBI/Semantic Scholar/NVIDIA, and the MANDATORY Level 3 "Real API Testing" via scripts/test_new_tools.py), so the skill fetches untrusted external content that is read and used to drive tool behavior.