GoList
PassAudited by ClawScan on May 1, 2026.
Overview
GoList appears purpose-aligned for managing grocery lists, but it sends list data to go-list.app, persists a local device/list state, and can create share links automatically.
This skill is reasonable to use if you trust go-list.app with your grocery list data. Before installing, be aware that it creates and stores a local device/list state file, sends list and item details to the GoList API, and may create a share link automatically after making a list. Keep share tokens private and reset the state file if you want to stop reusing the same device/list context.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A newly created grocery list may immediately get a share link, and anyone with that token may be able to join or view the list.
The skill deliberately creates a share token after list creation, which is useful for sharing but can expose access to the list if the URL or token is forwarded or pasted in the wrong place.
After `create-list`, always run `share` and send the URL/token to the user.
Keep GoList share URLs/tokens private and confirm that automatic sharing is acceptable before using the create-list flow.
The local device ID ties future GoList actions to the same device identity.
The generated device UUID acts as the skill's GoList device identity and is reused across requests. This is disclosed and purpose-aligned, but it is still an identifier that should not be casually exposed.
OpenClaw must generate its own random device UUID and persist it for reuse. Every request must include the `X-Device-Id` header.
Treat the local state file and any printed device identifiers as private; delete/reset the state file if you want a fresh device identity.
Future commands may operate on the previously active list, and the local state file may reveal list names/IDs and the device identifier.
The CLI persists state locally, including device/list information described in SKILL.md. That state helps future commands but also influences which list is active later.
DEFAULT_STATE_FILE = Path.home() / ".openclaw_golist_state.json"
Review or delete `~/.openclaw_golist_state.json` when changing users, devices, or list contexts; use `OPENCLAW_STATE_FILE` to isolate separate contexts if needed.