Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
- The skill documentation indicates file read/write behavior, but no permissions are declared for those capabilities. This creates a transparency and policy-enforcement gap: users or a hosting agent may approve the skill without understanding that it can access local files and write outputs, increasing the risk of unintended data exposure or filesystem modification.
