Picnic Grocery Shopping: why it is not safe to use

What we found

Our review did not find hidden prompts, hardcoded secrets, obfuscated code, undisclosed data sinks, or remote code fetches. Observed network use matched the stated Picnic integration, with optional routing through a user-configured HTTP(S) proxy.

The warning is based on two specific findings. First, the skill exposes account-changing actions, including clearing the cart, removing items, selecting delivery slots, canceling deliveries, and sending invoice emails. In the inspected tool handlers, we did not see a built-in confirmation gate before those actions execute. Second, the skill reads a Picnic username and password from environment variables and stores a local session auth key file. It also includes tools that access sensitive account areas such as payment profile and wallet transactions.

What to do instead

Use this skill only with clear human approval before any state-changing action. Prefer a setup that adds an explicit confirm step for cart changes, delivery changes, cancellations, and email sending. Keep credentials and session files tightly scoped, protect local storage, and avoid unnecessary proxy use unless you control and trust that proxy. Limit use of payment and wallet-related tools to cases where that access is actually needed.