Bring! Shopping List

• Outcome: Review
• Latest audit: Jul 25, 2026 · 8:18 AM UTC
• Version: 1.2.7

Overview

This is a disclosed Bring shopping-list integration, but users should understand it stores a reusable Bring password locally and may modify shared lists.

Install only if you are comfortable letting a local script store your Bring email, password, and tokens on this machine. Prefer the terminal setup path, avoid pasting credentials into chat, do not reuse that password elsewhere, and be careful with remove commands because shared-list changes sync immediately.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill performs shell execution and network access but does not declare permissions for those capabilities. That weakens platform-level transparency and policy enforcement, making it easier for users or orchestrators to invoke a skill without understanding it can run commands and contact external services. In this context the behavior is expected for the feature, but the undeclared capability is still a real security governance issue.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The README encourages a very broad setup phrase ('Set up the Bring shopping list skill') as a natural-language trigger, which can make an agent invoke sensitive setup flows when the user is only discussing shopping or installation at a high level. In this skill's context, setup may involve handling credentials, so ambiguous invocation increases the chance of prompting for or capturing secrets unintentionally.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The 'Just Talk Naturally' section promotes very open-ended phrases for list operations without defining clear trigger boundaries, making accidental or misparsed invocation more likely. Because these actions modify remote shopping lists and may operate on a default list automatically, an unintended trigger can cause unauthorized or mistaken state changes.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The skill explicitly allows users to paste their Bring! email and password into chat, then instructs the agent to store those credentials locally. Even with a warning, collecting secrets through chat materially increases exposure to conversation retention, logging, transcript access, downstream tooling, and accidental disclosure. This is especially sensitive because the stored password enables long-term account access, not just a temporary session.

External Transmission

Medium

• Category: Data Exfiltration

Content

enc_email="$(urlencode "$BRING_EMAIL")"
  enc_pass="$(urlencode "$BRING_PASSWORD")"
  local response http_code
  response=$(curl -s -w "\n%{http_code}" -X POST "${API_BASE}/v2/bringauth" \
    -H "X-BRING-API-KEY: ${API_KEY}" \
    -H "X-BRING-CLIENT: android" \
    -H "X-BRING-APPLICATION: bring" \

• Confidence: 95% confidence
• Finding: curl -s -w "\n%{http_code}" -X POST "${API_BASE}/v2/bringauth" \ -H "X-BRING-API-KEY: ${API_KEY}" \ -H "X-BRING-CLIENT: android" \ -H "X-BRING-APPLICATION: bring" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

public_uuid="$(get_header publicUuid)"

  local response http_code
  response=$(curl -s -w "\n%{http_code}" -X POST "${API_BASE}/v2/bringauth/token" \
    -H "Authorization: ${token_type} ${access_token}" \
    -H "X-BRING-API-KEY: ${API_KEY}" \
    -H "X-BRING-CLIENT: android" \

• Confidence: 84% confidence
• Finding: curl -s -w "\n%{http_code}" -X POST "${API_BASE}/v2/bringauth/token" \ -H "Authorization: ${token_type} ${access_token}" \ -H "X-BRING-API-KEY: ${API_KEY}" \ -H "X-BRING-CLIENT: android" \

Credential Access

High

• Category: Privilege Escalation

Content

- **Terminal (recommended):** enter your credentials privately in your own terminal via `read -s` — they never appear in the chat.
- **Chat (convenient):** paste them in chat. They're written straight to a local config file and never repeated by the agent — but, like any chat message, they then live in that conversation's history.

**Where credentials live:** your Bring! email + password are stored locally in `~/.config/bring/credentials.json` (`chmod 600`) and sent only to Bring!. The password is kept so the skill can re-login when its cached token expires, so treat that file as a secret.

## License

• Confidence: 95% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

- **Network:** talks only to Bring!'s official API at `api.getbring.com` — no third-party services, no telemetry, no other hosts.
- **Files written locally:**
  - `~/.config/bring/credentials.json` — the user's Bring! email + password (`chmod 600`, owner-only).
  - `~/.cache/bring/token.json` — cached access/refresh token.
- **Why the password is stored:** Bring!'s unofficial API has no token-only login. The skill caches a token and auto-refreshes it, but keeps the password so it can re-login once the token *and* refresh token expire. The stored password therefore grants ongoing access to the Bring! account from this machine — treat `credentials.json` as a secret.
- **Destructive actions:** `remove` / `remove-multi` permanently delete items, and every change syncs instantly to everyone on a shared list. Confirm with the user before removing items, especially on shared lists.

• Confidence: 96% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

- **Files written locally:**
  - `~/.config/bring/credentials.json` — the user's Bring! email + password (`chmod 600`, owner-only).
  - `~/.cache/bring/token.json` — cached access/refresh token.
- **Why the password is stored:** Bring!'s unofficial API has no token-only login. The skill caches a token and auto-refreshes it, but keeps the password so it can re-login once the token *and* refresh token expire. The stored password therefore grants ongoing access to the Bring! account from this machine — treat `credentials.json` as a secret.
- **Destructive actions:** `remove` / `remove-multi` permanently delete items, and every change syncs instantly to everyone on a shared list. Confirm with the user before removing items, especially on shared lists.

## Agent Setup Guide

• Confidence: 96% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# bring.sh — CLI for the Bring! Shopping Lists API
# Requires: curl, jq
# Auth: BRING_EMAIL + BRING_PASSWORD env vars, or ~/.config/bring/credentials.json
set -euo pipefail

###############################################################################

• Confidence: 97% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

# Public Bring! app API key — NOT a secret. Every Bring client uses this same key.
API_KEY="cof4Nc6D8saplXjE3h3HXqHH8m7VU2i1Gs0g85Sp"
TOKEN_FILE="${BRING_TOKEN_FILE:-${HOME}/.cache/bring/token.json}"
CRED_FILE="${BRING_CREDENTIALS_FILE:-${HOME}/.config/bring/credentials.json}"
# Country code for Bring API (affects item catalog language). Override in credentials.json.
BRING_COUNTRY="${BRING_COUNTRY:-DE}"

• Confidence: 98% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

"default_list" is set in credentials.json.

DEFAULT LIST:
  Add "default_list" to ~/.config/bring/credentials.json to skip
  specifying the list name every time:
  {"email": "...", "password": "...", "default_list": "Einkaufsliste"}

• Confidence: 96% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

AUTHENTICATION:
  Set BRING_EMAIL and BRING_PASSWORD env vars, or run 'bring.sh setup'
  to store credentials in ~/.config/bring/credentials.json

EXAMPLES:
  bring.sh setup

• Confidence: 97% confidence
• Finding: credentials.json

Session Persistence

Medium

• Category: Rogue Agent

Content

Run `scripts/bring.sh lists` first. If it works, setup is already done — skip to usage.

### Step 2: Set up credentials
Bring! requires an email + password. If the user doesn't have an account yet, they can create one for free at getbring.com or in the Bring! app.

**If they signed up via Google/Apple:** They need to set a direct password first in the Bring! app (Settings → Account → Change Password) before the API works.

• Confidence: 75% confidence
• Finding: create one for free at getbring.com or in the Bring! app. **If they signed up via Google/Apple:** They need to set a direct password first in the Bring! app (Settings → Account → Change Password) bef

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/bring.sh:12