Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
- The skill declares no permissions, yet its documented behavior includes shell commands, filesystem writes, environment-specific paths, hook installation, git/network-based installation flows, and cross-session features. This creates an authorization/transparency gap: users or platforms may trust the manifest as low-risk while the skill can influence persistent workspace state and interact with externally sourced content.
