Bring! Shopping Lists
PassAudited by ClawScan on May 10, 2026.
Overview
This appears to be a straightforward Bring! shopping-list integration, but it requires installing an npm package and storing Bring! login credentials locally.
Before installing, verify the bring-shopping npm package, understand that your Bring! email/password will be stored locally in ~/.openclaw/bring/config.json, and remember that add/remove actions can update shared shopping lists for other users.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone with access to the local config file may be able to see the stored Bring! login credentials.
The skill requires Bring! account credentials and stores them persistently on disk. This is expected for the integration and disclosed, but it is still sensitive account access.
Before first use, configure Bring credentials: ./bring configure <email> <password> ... Credentials are stored in ~/.openclaw/bring/config.json.
Use only on a trusted machine, protect the ~/.openclaw/bring/config.json file, and consider changing the Bring! password if the file is exposed.
Installing a global package gives that package code execution on the local machine during installation and use.
The skill depends on a global npm package that is not pinned to a specific version and is not installed through a declared install spec. This is central to the skill's purpose, but users should verify the package source.
npm install -g bring-shopping
Verify the npm package and its repository before installing, and prefer a pinned version if possible.
Items added or removed by the agent may immediately appear for other people who share the list.
The skill can mutate shared Bring! list contents. This is the stated purpose and is user-facing, but it affects shared remote data.
Add an item to a shopping list ... Remove an item from a shopping list ... Changes sync in real-time across all devices
Use clear user instructions for add/remove actions, especially on shared lists.