Listonic

Access Listonic shopping lists: list lists/items, add/check/delete items, and manage lists.

Security Scan

The skill's code, instructions, and requirements line up with its stated purpose (an unofficial CLI for Listonic); it asks for local tokens/passwords and performs network calls to Listonic endpoints, which is expected for this functionality.

Purpose & Capability

Name/description (manage Listonic lists) match the included Python CLI and shell wrapper. Required binary is python3, and the skill reads/writes a per-skill config file for tokens/passwords — all consistent with an API client.

Instruction Scope

SKILL.md instructs creating a local config at ~/.openclaw/credentials/listonic/config.json and running the provided scripts. The runtime instructions and the code operate only on that config path and the Listonic API; they do not request unrelated system files or external endpoints unrelated to Listonic functionality.

Install Mechanism

No external install/downloads are performed. This is an instruction-only skill with bundled code files executed locally. No remote installers, package downloads, or archive extraction are used.

Credentials

The skill requests no environment variables, only a local credentials file (token or email/password). It persistently stores tokens (including rotated refresh tokens) in plaintext at ~/.openclaw/credentials/listonic/config.json — expected for a client but something users should be aware of. The code includes a hard-coded default client_id/client_secret and a default redirect URI; embedding these values is plausible for a reverse-engineered web client but worth noting.

Persistence & Privilege

always is false and the skill only writes to its own config path. It auto-refreshes and persists tokens for convenience; it does not request system-wide settings or other skills' credentials.

Assessment

This skill appears to do what it says: a local CLI that talks to Listonic and stores your auth in ~/.openclaw/credentials/listonic/config.json. Before installing: (1) Prefer the token/refreshToken mode rather than supplying your email/password. (2) Be aware tokens (and rotated refresh tokens) are saved in plaintext at the given path — avoid placing them on shared machines. (3) Inspect the bundled scripts yourself if you want to confirm network endpoints; the code calls Listonic domains and includes a hard-coded client_id/client_secret and a non-Listonic redirect URI (likely from reverse-engineering). (4) If you are uncomfortable giving credentials, do not add them; the tool cannot work without valid credentials.

Manage Listonic shopping lists via the unofficial web API.

Setup

Create ~/.openclaw/credentials/listonic/config.json using one auth mode.

Recommended: token mode (works with Google sign-in)

{
  "refreshToken": "your-refresh-token"
}

Tip: the script now auto-refreshes access tokens and persists updated tokens back to config. It also accepts refresh_token / access_token keys if you paste raw OAuth payload JSON.

Optional (advanced):

{
  "accessToken": "short-lived-access-token",
  "clientId": "listonicv2",
  "clientSecret": "fjdfsoj9874jdfhjkh34jkhffdfff",
  "redirectUri": "https://listonicv2api.jestemkucharzem.pl"
}

Fallback: email/password mode

{
  "email": "[e-mail]",
  "password": "your-listonic-password"
}

Workflow

1. lists to show available shopping lists
2. items <list> to inspect current items
3. add-item <list> "Name" to add items
4. check-item / uncheck-item to toggle completion
5. delete-item only when user explicitly wants removal

Important

• This uses an unofficial reverse-engineered API and may break if Listonic changes it.
• For destructive operations (delete-item, delete-list), confirm with the user first.
• list arguments can be list ID or a list name (exact/partial match).

Commands

Show all lists

bash scripts/listonic.sh lists

Show items in a list

bash scripts/listonic.sh items 12345
bash scripts/listonic.sh items "Groceries"

Add item

bash scripts/listonic.sh add-item "Groceries" "Milk"
bash scripts/listonic.sh add-item "Groceries" "Flour" --amount 2 --unit kg

Check / uncheck item

bash scripts/listonic.sh check-item "Groceries" 987654
bash scripts/listonic.sh uncheck-item "Groceries" 987654

Delete item

bash scripts/listonic.sh delete-item "Groceries" 987654

Create / rename / delete list

bash scripts/listonic.sh add-list "BBQ Party"
bash scripts/listonic.sh rename-list "BBQ Party" "BBQ"
bash scripts/listonic.sh delete-list "BBQ"

Raw JSON output

bash scripts/listonic.sh --json lists
bash scripts/listonic.sh --json items "Groceries"