MCP Picnic: why it is not safe to use

What we found

Our review did not find hidden prompts, hardcoded secrets, obfuscated code, or signs of undisclosed remote code fetching. The documented network use appears limited to the user’s Picnic account and an optional HTTP server protected by a user-set token.

The main concern is account impact and data access. Based on the reviewed docs, this skill can take live actions in a Picnic account, including adding or clearing cart items, booking or canceling delivery slots, rating deliveries, and sending invoice emails. We did not see an explicit confirmation step described before those actions. The skill also requires a Picnic username and password, stores a local session token file, and can access account-linked information such as payment profile, wallet transactions, billing details, order history, and delivery information.

What to do instead

Use this skill only if you are comfortable granting account-level access and understand that it may perform changes on your behalf. Prefer setups where you can review each requested action before it is executed. Keep the optional HTTP endpoint disabled unless needed, use a strong token if you enable it, and limit use to a dedicated environment where local session files can be protected.