Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
- The skill performs network access and reads credentials/environment-backed configuration, but no explicit permission declaration is present in the manifest. This can undermine informed consent and platform policy enforcement because users may install a research skill without realizing it transmits data and uses secrets.
