Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
- The skill declares only an environment variable requirement, but the documented behavior clearly includes network access to external APIs and webhook listener functionality. Undeclared capabilities reduce informed consent and can cause hosts or users to grant the skill more effective power than its manifest communicates.
