Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
- The skill clearly performs network access to a local API and writes files into an Obsidian vault, yet no permissions are declared. This creates a transparency and policy-enforcement gap: users and the runtime may not be able to assess or restrict the skill’s actual capabilities before execution.
