ClawHub
Back to skill

Security audit

Bring! Shoppinglist

Security checks for vulnerabilities and agentic risk

Overview

This Bring! shopping-list skill is purpose-aligned, but it needs review because it combines broad activation, third-party account mutations, plaintext credential storage, and an unpinned dependency that receives the user's password.

Install only if you intend Bring! to be your shopping-list backend. Prefer environment variables or an OS secret store over the JSON password file; if you use the file, restrict it to owner-only permissions. Be explicit about Bring! and the target list before add, remove, or complete actions, and consider pinning/reviewing the bring-api dependency before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Dependency Handles Account Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:13-16
Vulnerability Type: Unpinned third-party dependency with access to credentials
Risk Level: Medium

Vulnerable Code

markdown
1. Install the Python dependency:

   ```bash
   python3 -m pip install bring-api
   ```

Related credential handoff in bring.py:202-204:

python
session = aiohttp.ClientSession()
bring = Bring(session, email, password)
await bring.login()

Technical Analysis

The installation command retrieves the latest available bring-api package without pinning a reviewed version or verifying an artifact hash. The documentation identifies this package as an unofficial Bring! API client.

Imported package code executes with the privileges of the Python process. In addition, the CLI passes the user's Bring! email address and password directly to the dependency during authentication. Consequently, a compromised or unexpectedly malicious package release could access those credentials, inspect other process-accessible data, make unauthorized network requests, or execute arbitrary Python code.

The dependency is relevant to the Skill's declared functionality, so using an API client does not itself exceed minimum necessary privileges. The security issue is that the dependency is fetched without integrity or version controls despite occupying a credential-sensitive trust position.

Attack Path

  1. An attacker compromises the upstream package, its maintainer account, or the package-distribution channel.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the documented python3 -m pip install bring-api command.
  4. The package is installed without a version constraint or hash verification.
  5. Malicious code runs during package installation or when bring_api is imported.
  6. During normal CLI use, the user's email and password are passed to attacker-controlled `Bring ...[truncated 699 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin bring-api to an exact, reviewed version rather than installing the latest release.
  • Provide a lock file containing hashes and require hash verification during installation.
  • Install only from a trusted, explicitly configured package index.
  • Review the selected release's source, transitive dependencies, authentication endpoints, and TLS behavior.
  • Automate dependency vulnerability and provenance checks before updating the pinned version.
  • Prefer a token with limited scope over a reusable account password if the service supports one.
  • Consider vendoring and auditing the limited API functionality needed by this Skill where licensing and maintenance constraints permit.

T09 · Insecure Skill Coding Practices

Note
Location
bring.py:30
Finding

Plaintext Credential File Lacks Ownership and Permission Safeguards

Content
View full analysis

Vulnerability Details

File Location: bring.py:30-48
Vulnerability Type: Insecure plaintext credential storage and unchecked file permissions
Risk Level: Low

Vulnerable Code

python
CREDENTIAL_PATH = Path.home() / ".openclaw" / "credentials" / "bring.json"


def load_credentials():
    """Load Bring! credentials from env vars or JSON file."""
    email = os.environ.get("BRING_EMAIL")
    password = os.environ.get("BRING_PASSWORD")

    if email and password:
        return email, password

    if CREDENTIAL_PATH.exists():
        data = json.loads(CREDENTIAL_PATH.read_text())
        email = data.get("email", "")
        password = data.get("password", "")
        if email and password:
            return email, password

The corresponding setup instructions at SKILL.md:18-26 explicitly recommend storing the password in JSON:

markdown
2. Configure credentials — set env vars `BRING_EMAIL` and `BRING_PASSWORD`, or create `~/.openclaw/credentials/bring.json`:

   ```json
   {
     "email": "your@email.com",
     "password": "your_password"
   }
   ```

Technical Analysis

Reading authentication material is necessary for the declared Bring! shopping-list functionality. However, the fallback design recommends keeping a reusable password in a plaintext JSON file and reads it without validating file ownership, file type, or permission mode.

Neither the implementation nor the documentation requires owner-only permissions such as mode 0600. If the file is created under a permissive umask, restored with unsafe permissions, or otherwise made group- or world-readable, another local account or process may retrieve the password. The implementation also follows the configured path without explicitly rejecting symbolic links or non-regular files, although practical exploitability depends on the local filesystem permissions and threat model.

Attack Path

  1. A use ...[truncated 1184 chars]
Remediation
View remediation

Remediation Suggestions

  • Prefer an operating-system credential manager or keyring instead of a plaintext JSON file.
  • Prefer a revocable, narrowly scoped token rather than the user's reusable account password if supported by Bring!.
  • If file storage remains necessary, document and enforce owner-only permissions, such as mode 0600, and owner-only permissions on the parent directory.
  • Before reading the file, use lstat-style checks to verify that it is a regular file, is owned by the current user, and has no group or world permission bits.
  • Reject unsafe permissions with a clear error rather than merely warning.
  • Avoid following symbolic links when opening the credential file where platform APIs permit.
  • Ensure credentials and authentication exceptions are never printed or included in diagnostic logs.
  • Recommend secret rotation if an existing credential file was ever broadly readable.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description includes broad trigger phrases like 'shopping list', 'Einkaufsliste', and 'add to shopping list' that can match many generic user requests, even when the user did not explicitly intend to use Bring! or disclose Bring! credentials. This can cause unintended activation of an external-integration skill and lead to actions against a third-party account without sufficient user confirmation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The skill instructs users to store Bring! credentials in a plaintext JSON file under the home directory, creating persistent local secrets that may be readable by other processes, backups, or users depending on filesystem permissions. Because the skill operates on a third-party account, compromise of these credentials enables unauthorized access and modification of the user's shopping lists and potentially broader account abuse if the password is reused.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

python3 -m pip install bring-api

text

2. Configure credentials — set env vars `BRING_EMAIL` and `BRING_PASSWORD`, or create `~/.openclaw/credentials/bring.json`:

```json
{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The common-pattern examples map very common natural-language requests directly to commands without defining when this skill should defer to other list systems or ask clarifying questions. In an agent environment with multiple tools, this ambiguity increases the chance of misrouting ordinary shopping-list requests into the Bring! integration and modifying the wrong external list.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
bring.py:204