Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
- The skill advertises executable scripts with file read/write and network behavior, but no permissions are declared. This creates a transparency and policy-enforcement gap: a host system or reviewer cannot accurately constrain the skill's access, and users may invoke functionality without understanding that local files and external APIs are involved.
