Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
- The skill documentation demonstrates file-writing capability (for example, exporting HTML/PDF reports and saving dashboards) but does not declare any corresponding permission. Undeclared write capabilities can bypass user expectations and platform controls, increasing the risk of unauthorized file creation or overwrite when the skill is invoked.
