Least-privilege remediation can broaden allowed-tools preapproval #674

Problem

With a detected shell capability and allowed-tools: [Read], an LP1 probe produces a HIGH finding and recommends adding a tool that covers shell execution. With the optional declaration absent, LP3 reports no declared scope. Adding Bash removes the probe finding.

That remediation can broaden preapproval instead of reducing authority. Optional skill metadata is not, by itself, proof of the host's enforced permission ceiling.

The Agent Skills specification defines an optional, experimental preapproval field. Claude Code's tool-preapproval documentation describes its host-specific behavior. Neither justifies treating absence of this field as proof of unlimited runtime access.

Expected behavior

Distinguish tool preapproval from observed capabilities and evidence of runtime enforcement. Remediation should not tell users to broaden approval grants merely to silence a finding. Continue reporting dangerous capabilities and broad grants when supported, and state when runtime permissions are unknown.

Related work

#300 and #313 concern the field name used in remediation. PR #447 corrects EA1 wildcard patterns. Those changes do not address the distinction between preapproval and enforced permissions.

Relevant code

mcp_least_privilege.py:537, mcp_least_privilege.py:562, mcp_least_privilege.py:619.