Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
- The skill advertises Bash execution and, per the static finding, performs network access without declaring corresponding permissions. Undeclared network capability weakens user trust and reviewability because prompts, tokens, or generated content may be sent off-host without explicit disclosure or permission metadata.
