Bring! Shopping List App (Unofficial)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:47 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it asks users to pass account credentials to an unpinned third-party npm package.

Review the npm package and pin a known version before installing. Use a dedicated Bring! account or password if possible, keep BRING_EMAIL and BRING_PASSWORD scoped only to this CLI, and confirm the target list and item before remove, check, or uncheck actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Third-Party Dependency Receives Account Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:10-15 and scripts/bring_cli.mjs:2, 35-43
Vulnerability Type: Unpinned third-party dependency with access to sensitive credentials
Risk Level: Medium

Vulnerable Code

SKILL.md:10-15:

markdown

Use the `bring-shopping` npm package to access Bring! lists with email/password credentials. Default list is "Willig" unless the user specifies otherwise.

## Quick Start

1. Install dependency in the skill folder:
   - `npm install bring-shopping`

scripts/bring_cli.mjs:2, 35-43:

javascript

import Bring from 'bring-shopping';

const mail = process.env.BRING_EMAIL;
const password = process.env.BRING_PASSWORD;
if (!mail || !password) {
  console.error('Missing BRING_EMAIL or BRING_PASSWORD environment variables.');
  process.exit(1);
}

const bring = new Bring({ mail, password });
await bring.login();

Technical Analysis

The installation instructions use npm install bring-shopping without an exact dependency version. The project provides no package.json, lockfile, integrity metadata, vendored source, or other reproducible dependency control. Consequently, users may install whichever package version and transitive dependency graph the registry resolves at installation time.

The imported package executes in the local Node.js process and is explicitly supplied with the user's Bring! email address and plaintext password. Because an npm dependency has the same effective operating-system privileges as the CLI, a compromised or unexpectedly changed package version could inspect credentials, environment variables, shopping-list data, and locally accessible files. It could also perform arbitrary network requests or execute other actions available to the current user.

This finding concerns supply-chain trust and reproducibility. The reviewed source does not itself prove that the current bring-shopping package is malicious.

A

...[truncated 1234 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a package.json declaring an audited, exact bring-shopping version rather than a range or unqualified package name.
2. Generate and commit a lockfile so the complete transitive dependency graph and integrity hashes are reproducible.
3. Direct users to install with npm ci rather than an unconstrained npm install bring-shopping.
4. Verify the expected npm registry, package publisher, source repository, and package integrity before installation.
5. Audit the selected package version and its transitive dependencies, including installation scripts and network behavior.
6. Use automated dependency monitoring and require review before lockfile updates.
7. Prefer an official API and revocable, narrowly scoped authentication token instead of a reusable account password if Bring! supports such authentication.
8. Run the CLI under a dedicated least-privileged account or sandbox with restricted filesystem, environment, process-execution, and network access.
9. Avoid exposing unrelated secrets in the CLI process environment.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill uses environment-based credentials (BRING_EMAIL and BRING_PASSWORD) but does not declare any explicit tool scope or permission boundary in the skill metadata. That omission can cause the agent runtime to grant broader-than-expected access or make credential use insufficiently transparent, increasing the chance of unauthorized secret access or execution in contexts that did not intend env exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents commands that modify or delete shopping-list state (add, remove, check, uncheck) without requiring confirmation or warning the operator before destructive actions. In an agent setting, ambiguous natural-language requests or incorrect list/item resolution could lead to unintended list changes, data loss, or user confusion across shared household lists.

Content

No source excerpt is available for this finding.