Pico is a local security analysis tool that maps attack paths through coding agents by discovering how untrusted external influence can reach consequential authority. It runs entirely on your machine without cloud backends or telemetry, storing findings in a local SQLite database and providing evidence-based identification of security risks.