Undeclared Tool Scope
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares it requires environment access and performs authenticated network operations, but it does not define an explicit tool scope such as permissions or allowed-tools. This increases the risk of overbroad execution in agent environments, because consumers cannot easily constrain what the skill is permitted to access or transmit.
- Content
