Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
- The skill advertises shell-based installation and operational commands (`./pmm_watch.sh ...`) but does not declare corresponding permissions or capabilities. This creates a transparency and consent problem: users and platforms cannot accurately assess what the skill may execute, increasing the risk of unexpected local command execution and side effects.
