Bring! Shopping List App (Unofficial)

• Analyzed: May 12, 2026, 3:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: f9ec764e3ea793cb011fa49b068da9ada2d92607235bd0736fc802420b769875
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to manage Bring! shopping lists using the `bring-shopping` Node.js library. It securely retrieves credentials (`BRING_EMAIL`, `BRING_PASSWORD`) from environment variables as recommended in `SKILL.md` and uses them solely for authenticating with the Bring! API. The `scripts/bring_cli.mjs` file implements the stated functionality without any evidence of data exfiltration, malicious execution, persistence, or prompt injection attempts against the agent. All actions are directly related to the skill's stated purpose.