Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
- The skill clearly requires environment variables, network access, and an external client script, yet it does not declare permissions or capabilities up front. This weakens user and platform visibility into what the skill can access, increasing the risk of unintended credential use or silent data exfiltration through remote API calls.
