Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
- The skill documentation describes executable components that use environment variables, write files, and access external network services, yet no permissions are declared. This creates a transparency and policy-enforcement gap: an agent or reviewer may authorize the skill based on incomplete capability disclosure, allowing outbound data access or filesystem side effects that were not explicitly consented to.
