Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
- The skill advertises use of multiple external public APIs and a technical architecture, but it declares no permissions despite requiring network access and likely environment-based configuration. This creates a transparency and governance gap: users and the platform may not realize the skill can transmit queries externally, which can lead to unauthorized data exposure or execution beyond expected trust boundaries.
