Shopping List Ui

Web UI for the shopping-list skill. Adds a /shopping page to Second Brain with full CRUD — view, add, edit, check off, and delete items. Requires the shoppin...

Security Scan

The skill's declared purpose (a web UI that reads/writes the shopping-list skill data and modifies the Second Brain app) matches its instructions, but because it will write application files and the package has no source/homepage you should review changes before applying them.

Purpose & Capability

Name/description (Shopping List UI) align with the instructions: the SKILL.md describes adding a /shopping page, API routes, data layer, and small component changes. All requested actions (reading/writing skills/shopping-list/data/*.json and modifying second-brain app files) are coherent with a UI integration for the shopping-list skill.

Instruction Scope

Instructions explicitly direct the agent to add/modify specific app files and to read/write the shopping-list skill's JSON data files (active.json and config.json). There are no references to unrelated system paths, external network endpoints, or hidden data exfiltration. However, the instructions grant the agent write access to the app codebase — this is expected for a UI plugin but is a non-trivial scope that merits manual review of changes.

Install Mechanism

No install spec and no code files (instruction-only). That is the lowest-risk installation vector because nothing is automatically downloaded or executed; the agent will follow the prose instructions to create/modify files.

Credentials

The skill declares no required environment variables, credentials, or config paths. The SKILL.md reads user identity from skills/shopping-list/data/config.json (documented). This local config access is proportional to the stated purpose, but you should confirm that config.json contains only identity metadata and not sensitive secrets.

Persistence & Privilege

The skill will persistently modify the Second Brain app (add files and change components). always:false and default autonomous invocation are set. Modifying the codebase is legitimate for this UI integration, but it is a privileged action (writes to repo). Require a manual review/approval step before applying changes to production.

Assessment

This skill is coherent with its stated purpose, but it will create and modify files inside your Second Brain app and read the shopping-list JSON data. Before installing: 1) Verify the shopping-list skill is installed and working. 2) Backup your repo or use a feature branch. 3) Ask the publisher for source code or a repo URL (none is provided) and review the exact file diffs the skill will apply. 4) Inspect skills/shopping-list/data/config.json to ensure it doesn't contain secrets you don't want accessed. 5) Test changes in a local/dev environment before deploying. If you cannot review or do not trust the skill author, decline or reimplement the UI changes manually.

Web interface for managing the shopping list. Adds a /shopping page to the Second Brain portal with categorized list view and inline editing.

Prerequisites

• Second Brain portal running (Next.js)
• shopping-list skill installed (clawhub install shopping-list)

Files

This skill adds the following files to the Second Brain app:

File	Purpose
second-brain/src/lib/shopping.ts	Data layer — reads/writes shopping-list skill JSON files
second-brain/src/app/api/shopping/route.ts	GET list + POST add item
second-brain/src/app/api/shopping/[id]/route.ts	PUT edit, DELETE remove, PATCH check-off
second-brain/src/app/shopping/page.tsx	Shopping list page with CRUD UI

Also modifies:

• second-brain/src/components/Sidebar.tsx — adds Shopping nav entry
• second-brain/src/components/SFIcon.tsx — adds cart.fill icon

Data

Reads and writes skills/shopping-list/data/active.json — the same file used by the conversational shopping-list CLI skill. Changes made in the web UI are immediately visible in chat, and vice versa.

User identity for addedBy is read from skills/shopping-list/data/config.json. If not set, defaults to "web".