Bring! Shopping List
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill is mostly coherent for managing Bring shopping lists, but it asks for a Bring account password in chat while also making potentially misleading privacy claims about credentials never leaving the machine.
Only install if you are comfortable giving this skill access to your Bring account and shopping lists. Prefer the terminal setup path so your password is not posted into chat, and be aware that list changes can immediately sync to other people sharing the list.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the user chooses the chat option, their Bring password may be exposed to the chat/agent environment and any systems that retain conversation history.
The skill asks the user to provide a direct account password to the agent in chat, then stores it for future API access. That credential access is central to the integration, but it is high-impact and not safely scoped to a private credential-entry flow.
"I need your Bring! email and password. You can either share them here in chat (I'll write them to a config file and never mention them again)"
Use the terminal/private-entry option instead of sharing the password in chat, and consider using a dedicated Bring account or rotating the password after setup.
A user may trust the privacy statement and disclose their password in chat without realizing that this is different from entering it locally in a terminal.
The privacy claim is too broad because the documented chat setup path requires the user to transmit credentials through the conversation before they are written locally.
"Your credentials never leave your machine" ... "share credentials in chat (convenient, written directly to file and never repeated)"
The skill should remove or qualify the 'never leave your machine' claim and make the private terminal setup the preferred default.
Items added, removed, or checked off by the agent may appear immediately for other people sharing the list.
The skill can mutate third-party Bring shopping lists, including lists shared with family or partners. This is purpose-aligned and disclosed, but users should understand the immediate shared impact.
"Changes made by the agent sync instantly to all devices sharing that list."
Confirm the target list before batch changes or removals, especially when multiple or shared Bring lists are configured.