Security audit
Bring! Shopping List App (Unofficial)
Security checks across malware telemetry and agentic risk
Overview
This skill appears benign: it openly uses Bring credentials to run explicit shopping-list commands, with no hidden persistence or unrelated data handling found.
Install only if you are comfortable giving the skill Bring account credentials. Specify the target list for write actions, review add/remove/check/uncheck requests before running them, and consider pinning or reviewing the bring-shopping npm dependency before using it with a real account.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
63/63 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.