Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
- The declared behavior says the skill fetches NASA POWER data, but the workflow also sends user-supplied locations to OpenStreetMap Nominatim for geocoding. This mismatch can mislead users and reviewers about third-party data disclosure and network behavior, which is especially sensitive when users provide precise addresses.
