Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
- The skill invokes Python scripts that require environment access for BAIDU_API_KEY and network access to Baidu APIs, but those capabilities are not explicitly declared as permissions. This creates a transparency and policy-enforcement gap: users or hosting platforms may approve or run the skill without understanding that it can access secrets and communicate externally.
