Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
- The skill advertises use of environment variables and references implementation files that imply network, file read, and possibly file write capabilities, but it does not declare permissions or otherwise warn operators about those capabilities. This creates a transparency and governance gap: users or platforms may authorize and run the skill without understanding it can access secrets and make external requests.
