Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
- The skill declares runnable Bash commands that can install packages, build code, and execute a Node CLI, which implies network access and environment/file access, yet it does not declare corresponding permissions. This creates a transparency and least-privilege problem: users and hosting systems may underestimate what the skill can access or do at runtime.
