Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
- The skill documents use of environment variables and outbound API calls to ElevenLabs, but no permissions are declared to signal those capabilities. This creates a transparency and policy gap: agents or reviewers may approve or invoke the skill without realizing it accesses secrets and sends data off-system.
