Description-Behavior Mismatch
Medium
- Confidence
- 83% confidence
- Finding
- The requested OAuth scopes include photoslibrary.sharing even though the stated skill purpose is upload, album creation, and listing library content. Over-broad scopes increase blast radius if the token is exposed or the skill is later extended, because it grants sharing-related capabilities beyond the minimally necessary permissions.
