The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (MEDIUM): The skill instructs the user/agent to run @picahq/mcp via npx. This package is downloaded from the public NPM registry at runtime. As the author organization (picahq) is not in the trusted list, this introduces a dependency on an external, unverifiable source.
[REMOTE_CODE_EXECUTION] (MEDIUM): The use of npx @picahq/mcp within the MCP configuration and the Vercel AI SDK integration code results in the execution of third-party code as a local subprocess. While this is the intended primary purpose of the skill, it constitutes remote code execution from an untrusted source.
[DATA_EXFILTRATION] (MEDIUM): In the 'Integration pattern' and 'Working example' sections, the skill recommends spreading the entire process.env object into the environment variables passed to the MCP subprocess (env: { ...process.env ... }). This is a security anti-pattern that exposes all system environment variables—potentially including sensitive AWS keys, database credentials, or other API tokens—to the third-party @picahq/mcp package.
[COMMAND_EXECUTION] (LOW): The skill provides a diagnostic command using find and -exec sh -c to check for version mismatches in node_modules. While this is a shell command execution, it is presented as a developer utility for troubleshooting rather than an automated agent action.
[INDIRECT_PROMPT_INJECTION] (LOW): The skill facilitates tool calling from a third-party MCP server.
Ingestion points: Tool outputs from @picahq/mcp are ingested into the AI agent's context via streamText.
Boundary markers: None specified in the prompt integration code.
Capability inventory: The agent can execute tool calls and process results via npx.
Sanitization: No explicit sanitization of tool outputs is mentioned before they are processed by the LLM.

pica-mcp