Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
- The documented packaging/obfuscation workflow includes optional deletion of plaintext benchmark JSON files, which is a real integrity risk in an automated agent setting if exposed without strict scoping or confirmation. The danger is amplified because the skill description is broad and may cause invocation in contexts where users did not intend repository-modifying or destructive behavior.
