pica-openai-agents

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs "npx @picahq/mcp" at runtime (executes the remote package https://www.npmjs.com/package/@picahq/mcp), which fetches and runs external code that provides MCP tool definitions that can directly control agent tool calls/instructions and is required for the skill to function.