← Back to Skills Marketplace
maikimolto

Bring! Shopping List

by MaikiMolto · GitHub ↗ · v1.2.5
cross-platform ✓ Security Clean
799
Downloads
2
Stars
1
Active Installs
10
Versions
Install in OpenClaw
/install bring-list
Description
Manage Bring! shopping lists (Einkaufsliste / grocery list) — add, remove, check off items, batch ops, default list support. Use when: user wants to set up B...
README (SKILL.md)

Bring! Shopping Lists

Manage Bring! shopping lists via the unofficial REST API. Requires curl and jq.

Agent Setup Guide

When a user asks you to set up or use Bring for the first time, follow these steps:

Step 1: Check if already configured

Run scripts/bring.sh lists first. If it works, setup is already done — skip to usage.

Step 2: Set up credentials

Bring! requires an email + password. If the user doesn't have an account yet, they can create one for free at getbring.com or in the Bring! app.

If they signed up via Google/Apple: They need to set a direct password first in the Bring! app (Settings → Account → Change Password) before the API works.

Ask the user how they'd like to provide their credentials:

"I need your Bring! email and password. You can either share them here in chat (I'll write them to a config file and never mention them again), or if you prefer to keep them out of the chat entirely, I can give you a terminal command to enter them privately. Which do you prefer?"

Option A — via chat (convenient): User shares email + password in chat. Write them directly to the config file using jq for safe JSON encoding (prevents injection via special characters) and do not echo them back:

mkdir -p ~/.config/bring
jq -n --arg e "USER_EMAIL" --arg p "USER_PASSWORD" '{email: $e, password: $p}' > ~/.config/bring/credentials.json
chmod 600 ~/.config/bring/credentials.json

After writing, confirm: "Done — credentials saved securely. I won't repeat them."

Option B — via terminal (more private): Give the user this command to run in their own terminal. Credentials never appear in chat:

mkdir -p ~/.config/bring
read -rp "Bring! Email: " BEMAIL
read -rsp "Bring! Password: " BPASS && echo
jq -n --arg e "$BEMAIL" --arg p "$BPASS" '{email: $e, password: $p}' > ~/.config/bring/credentials.json
chmod 600 ~/.config/bring/credentials.json
unset BEMAIL BPASS

Tell the user: "Run that in your terminal, then come back and I'll continue the setup."

⚠️ Do NOT use scripts/bring.sh setup — it requires an interactive terminal (TTY) which agents don't have. Always create the credentials file manually as shown in Step 3.

Step 3: Save credentials and test login

mkdir -p ~/.config/bring
jq -n --arg e "USER_EMAIL" --arg p "USER_PASSWORD" '{email: $e, password: $p}' > ~/.config/bring/credentials.json
chmod 600 ~/.config/bring/credentials.json
scripts/bring.sh login

If login fails: double-check email/password. The user may need their Bring! password (not Google/Apple SSO — Bring requires a direct account password).

Step 4: Show existing lists and ask for a default

scripts/bring.sh lists

This shows all the user's Bring! lists. The user may have multiple lists, e.g.:

  • Einkaufsliste (main grocery list)
  • Drogerie (drugstore items)
  • Baumarkt (hardware store)
  • A shared list with a partner/family

If the user has NO lists: Tell them to create one in the Bring! app first. The API does not support creating or deleting lists — this must be done in the app. Once they've created a list, continue with setup.

Ask the user which list should be the default. This lets them skip typing the list name every time.

If they have only ONE list: set it as default automatically and inform them. If they have MULTIPLE lists: show the list names and ask which one to use as default. Explain they can still target other lists by name (e.g., "Put nails on the Baumarkt list").

Step 5: Set default list

Update the credentials file to include the chosen default:

# Read existing config and add default_list
jq --arg list "CHOSEN_LIST_NAME" '. + {default_list: $list}' ~/.config/bring/credentials.json > /tmp/bring_conf.json && mv /tmp/bring_conf.json ~/.config/bring/credentials.json
chmod 600 ~/.config/bring/credentials.json

Step 6: Confirm setup

Show the user their current list content to confirm everything works:

scripts/bring.sh show

Tell them: "All set! You can now say things like 'Put milk on the list' or 'What's on the shopping list?'"

Important: Lists can only be managed in the app

The Bring! API does not support creating or deleting lists. If the user asks to create a new list or delete one, tell them: "Lists can only be created and deleted in the Bring! app. Once you've made the change there, I can immediately work with the new list."

Handling shared lists

Bring! lists are often shared between family members or partners. Changes made by the agent sync instantly to all devices sharing that list. Inform the user:

  • "Any items I add will show up immediately on all phones that share this list."
  • This is usually desired (e.g., partner sees the updated grocery list), but worth mentioning.

Setup (manual / reference)

Credentials via env vars BRING_EMAIL + BRING_PASSWORD, or config file ~/.config/bring/credentials.json:

{"email": "[email protected]", "password": "secret", "default_list": "Einkaufsliste"}

Interactive setup (TTY required): scripts/bring.sh setup

Commands

All commands accept a list name (partial match) or UUID. If default_list is configured, the list argument can be omitted.

# List all shopping lists
scripts/bring.sh lists

# Show items on a list (or default list)
scripts/bring.sh show
scripts/bring.sh show "Einkaufsliste"

# Add item (with optional specification/quantity)
scripts/bring.sh add "Milch" "fettarm, 1L"
scripts/bring.sh add "Einkaufsliste" "Milch" "fettarm, 1L"

# Add multiple items at once (use "item|spec" for specifications)
scripts/bring.sh add-multi "Brot" "Käse|Gouda" "Butter|irische"

# Complete/check off item (moves to recently purchased)
scripts/bring.sh complete "Milch"

# Complete multiple items at once
scripts/bring.sh complete-multi "Milch" "Brot" "Käse"

# Move item back from recently to purchase list
scripts/bring.sh uncomplete "Milch"

# Remove item entirely
scripts/bring.sh remove "Milch"

# Remove multiple items at once
scripts/bring.sh remove-multi "Milch" "Brot" "Käse"

Targeting specific lists

When the user has multiple lists, they can target a specific one by name:

  • "Put nails on the Baumarkt list" → scripts/bring.sh add "Baumarkt" "Nails"
  • "What's on the Drogerie list?" → scripts/bring.sh show "Drogerie"

List names support partial case-insensitive matching, so "einkauf" matches "Einkaufsliste".

If no list is specified, the default_list from the config is used.

JSON Output

Append --json to lists and show for raw JSON:

scripts/bring.sh lists --json
scripts/bring.sh show --json
scripts/bring.sh show "Einkaufsliste" --json

Notes

  • Specifications are the small description text under an item (e.g., quantity, brand)
  • complete moves items to "recently purchased" (like checking off in the app)
  • remove deletes items entirely from the list
  • Token is cached at ~/.cache/bring/token.json and auto-refreshed
  • Changes sync instantly to all devices sharing the list
  • Item names with special characters (quotes, umlauts, emoji) are fully supported
  • Bring! requires a direct account password — Google/Apple SSO logins don't work with the API
  • country in credentials.json controls the item catalog language (default: DE)
  • When showing items to the user, consider only showing the "TO BUY" section unless they specifically ask for recently completed items — the recently list can be very long
  • If remove fails with "not found", suggest the user check the exact item name with show
  • Creating/deleting lists is not supported by the Bring! API — users must manage lists in the Bring! app
Usage Guidance
This skill appears to do what it says, but it requires your Bring! email and password. Prefer the 'Option B — via terminal' path so credentials never appear in chat or the platform logs. Before installing or running: (1) review scripts/bring.sh yourself (it's included) to confirm it's acceptable, (2) run it only on a trusted machine (not a shared or public CI runner), (3) store credentials with the recommended file permissions (chmod 600), (4) be aware that changes sync instantly to shared lists (others will see edits), and (5) verify network traffic goes only to api.getbring.com. If you want extra safety, create a dedicated Bring! account for automation rather than using your primary account.
Capability Analysis
Type: OpenClaw Skill Name: bring-list Version: 1.2.5 The OpenClaw skill 'bring-list' is classified as benign. The `SKILL.md` provides clear, privacy-first instructions for the AI agent on handling user credentials, including using `jq` for safe JSON encoding to prevent injection and `chmod 600` for secure file storage. The `scripts/bring.sh` uses `curl` and `jq` for legitimate interactions with the official Bring! API (`api.getbring.com`), employing robust URL encoding and JSON construction methods to prevent shell injection. There is no evidence of data exfiltration, unauthorized network activity, persistence mechanisms, or malicious prompt injection attempts against the agent.
Capability Assessment
Purpose & Capability
Name/description match the provided files: a single bash CLI (scripts/bring.sh) that uses curl + jq to call the Bring! REST API. Required capabilities (credentials, local config files, token cache) are expected for this purpose and nothing unrelated (no cloud provider keys, no unrelated binaries) is requested.
Instruction Scope
SKILL.md stays within scope (setup, storing credentials locally, listing/adding/removing items). It explicitly tells the agent how to obtain and store Bring! email/password and how to run the script. Important privacy note: SKILL.md offers two flows — entering credentials in chat (agent writes them to ~/.config/bring/credentials.json) or entering them locally via a provided terminal command. Allowing credentials to be pasted into chat is a privacy risk (chat logs/platform storage may retain them); the guidance to prefer terminal input for privacy is appropriate. There are no instructions to transmit credentials to any endpoint other than Bring!'s API (api.getbring.com).
Install Mechanism
No remote install/download steps — the skill is instruction-only plus a bundled shell script. Nothing is fetched from arbitrary URLs or written to unexpected system locations. The script creates/uses user-scoped config/cache files under ~/.config and ~/.cache only.
Credentials
The skill legitimately requires Bring! credentials (email/password) and may accept BRING_EMAIL/BRING_PASSWORD env vars; these are proportional to its functionality. No unrelated or excessive environment variables or external service credentials are requested.
Persistence & Privilege
always:false (not force-included). The script stores a token cache (~/.cache/bring/token.json) and credentials (~/.config/bring/credentials.json) with recommended file permissions (chmod 600). It does not request elevated system privileges or modify other skills' configs.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install bring-list
  3. After installation, invoke the skill by name or use /bring-list
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.2.5
Security fix: replaced unsafe cat<<EOF credential writing with jq --arg for proper JSON escaping (prevents injection). Improved urlencode sed fallback coverage.
v1.2.4
Improved description: better agent triggers, search keywords, privacy note
v1.2.3
README: removed misleading 'zero dependencies' claim, added privacy-first credential setup docs.
v1.2.2
Privacy-first credential setup: agent now asks whether to share credentials in chat or enter privately via terminal. Fixed urlencode() to prefer jq (documented dep) over python3. Updated description to highlight privacy feature.
v1.2.1
Improved description: highlights security scan results, zero dependencies, and guided agent setup.
v1.2.0
Rewritten README with clearer feature comparison and plain language.
v1.1.2
Better documentation: Agent Setup Guide now covers no-lists scenario, dedicated section explaining lists must be created/deleted in app (API limitation).
v1.1.1
Removed create-list (Bring API accepts request but lists don't appear in app). Filter null/ghost lists from output. Lists must be created/deleted in the Bring app.
v1.1.0
Added create-list command with themed icons (grocery, home, work, school, trip, party, baby, pet, christmas, easter). Note: list deletion is not supported by the Bring API.
v1.0.0
Initial release — zero-dependency Bring! integration with full CRUD, batch operations, default list support, and agent setup guide. Only requires curl + jq.
Metadata
Slug bring-list
Version 1.2.5
License
All-time Installs 1
Active Installs 1
Total Versions 10
Frequently Asked Questions

What is Bring! Shopping List?

Manage Bring! shopping lists (Einkaufsliste / grocery list) — add, remove, check off items, batch ops, default list support. Use when: user wants to set up B... It is an AI Agent Skill for Claude Code / OpenClaw, with 799 downloads so far.

How do I install Bring! Shopping List?

Run "/install bring-list" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Bring! Shopping List free?

Yes, Bring! Shopping List is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Bring! Shopping List support?

Bring! Shopping List is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Bring! Shopping List?

It is built and maintained by MaikiMolto (@maikimolto); the current version is v1.2.5.

💬 Comments