Bring! Shopping List App (Unofficial)

Manage Bring! shopping lists via the unofficial bring-shopping Node.js library using email/password login. Use for listing lists, reading items, adding/removing items, and checking/unchecking items when API-style access is acceptable.

Security Scan

The skill appears to do what it claims (manage Bring! lists) but has inconsistencies and modest supply-chain/credential risks you should understand before installing.

Purpose & Capability

The name/description and the included CLI script align: it uses the unofficial bring-shopping Node.js library to list and modify Bring! lists. However, the skill metadata declares no required environment variables or primary credential even though the README and script require BRING_EMAIL and BRING_PASSWORD — that's an inconsistency that should have been declared.

Instruction Scope

SKILL.md limits runtime actions to installing the bring-shopping npm package, reading BRING_EMAIL/BRING_PASSWORD, and running scripts that call the Bring API. The instructions do not ask the agent to read unrelated files or exfiltrate data to third-party endpoints. They do instruct you to store raw email/password in the agent config, which is sensitive and should be considered carefully.

Install Mechanism

There is no formal install spec — the SKILL.md tells the operator to run `npm install bring-shopping` in the skill folder. That means at runtime someone (or an automated process) will fetch code from the npm registry; this is a moderate supply-chain risk and should be reviewed (verify the package source, version, and maintainers). The skill itself does not bundle the bring-shopping dependency.

Credentials

The script requires BRING_EMAIL and BRING_PASSWORD to log in, but the skill metadata does not declare these required env vars or a primary credential. Requesting a user email and password is proportionate to the stated purpose, but storing raw passwords is sensitive — the metadata omission and lack of explicit primaryEnv are problematic and increase risk of accidental credential exposure.

Persistence & Privilege

The skill is not always-included and does not request elevated platform privileges. It does suggest storing credentials in the Clawdbot config but does not modify system or other skills' configs. Autonomous invocation is enabled by default (standard) but not combined with other high-risk flags.

What to consider before installing

Before installing: verify the npm 'bring-shopping' package is trustworthy (check the npm page, repository, release date, and maintainers); prefer an API token or app-specific credential rather than your primary Bring! password if possible; be aware the SKILL.md and script require BRING_EMAIL/BRING_PASSWORD but the registry metadata did not declare them — treat that as a red flag and ask the publisher to correct it; review the bring_cli.mjs code (it is short and only prints JSON to stdout) and consider running it in a sandbox or with a throwaway account first. If you must use your real account, limit the skill to user-invoked use and avoid giving it always-on/autonomous invocation until you trust the package and credential handling.

Bring Shopping

Overview

Use the bring-shopping npm package to access Bring! lists with email/password credentials. Default list is "Willig" unless the user specifies otherwise.

Quick Start

1. Install dependency in the skill folder:
   • npm install bring-shopping
2. Set environment variables in the Clawdbot config (preferred) or shell:
   • BRING_EMAIL and BRING_PASSWORD
3. Run the CLI script:
   • node scripts/bring_cli.mjs items --list "Willig"

Tasks

Show lists

• node scripts/bring_cli.mjs lists

Show items

• node scripts/bring_cli.mjs items --list "Willig"

Add items

• node scripts/bring_cli.mjs add --item "Milch" --spec "2L" --list "Willig"

Remove items

• node scripts/bring_cli.mjs remove --item "Milch" --list "Willig"

Check items

• node scripts/bring_cli.mjs check --item "Milch" --list "Willig"

Uncheck items

• node scripts/bring_cli.mjs uncheck --item "Milch" --spec "2L" --list "Willig"

Notes

• Store credentials in Clawdbot config env so they are not bundled with the skill.
• If the list name is ambiguous, run lists and ask which list to use.
• If an item is already checked, uncheck re-adds it to the purchase list.