Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 97% confidence
- Finding
- The skill documents network access and use of an environment-stored API key, but it does not declare an explicit tool scope such as allowed-tools or permissions. That mismatch reduces transparency and weakens policy enforcement, making it easier for an agent runtime to grant broader capabilities than reviewers expect.
