hugging-face-tool-builder

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's scripts fetch and parse public, user-generated content from the Hugging Face Hub (e.g., https://huggingface.co/api/models, model cards and raw README.md via hf download and raw URLs), so the agent will read and interpret untrusted third‑party content as part of its workflow.