Anylist

PassAudited by ClawScan on May 1, 2026.

Overview

The skill coherently manages AnyList shopping lists, with ordinary but noticeable risks from installing a global CLI, authenticating to AnyList, and allowing list changes.

This skill appears coherent for managing AnyList shopping lists. Before installing, make sure you trust the 'anylist-cli' npm package, authenticate only the AnyList account you want managed, and ask the agent to confirm before removing or clearing list items.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the CLI is necessary to use the skill, but it means trusting that npm package on the local system.

Why it was flagged

The skill asks the user to install a global npm CLI package as its operating mechanism. This is central to the stated purpose, but users should notice the external package dependency.

Skill content

npm install -g anylist-cli

Recommendation

Install only from a trusted npm source, verify the package name and publisher, and keep the CLI updated.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The CLI may be able to read and modify the user's AnyList shopping lists after authentication.

Why it was flagged

The skill requires access to the user's AnyList account through interactive authentication or optional email/password environment variables. This is expected for managing an AnyList account, but it is sensitive account access.

Skill content

anylist auth

# Or set environment variables for non-interactive use
export ANYLIST_EMAIL="your@email.com"
export ANYLIST_PASSWORD="your-password"

Recommendation

Prefer interactive authentication where possible, avoid exposing the password unnecessarily, and only use the skill with an account you intend it to manage.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

A mistaken list or item name could remove or clear shopping-list entries the user wanted to keep.

Why it was flagged

The skill documents commands that can remove items or clear checked items from a list. These actions are purpose-aligned for list management, but they mutate user data.

Skill content

anylist remove "Grocery" "Milk"     # Remove from list
anylist clear "Grocery"             # Clear all checked items

Recommendation

Use these commands only in response to clear user intent, and confirm ambiguous remove or clear requests before acting.