功能描述

Manage Bring! shopping lists via the unofficial bring-shopping Node.js library using email/password login. Use for listing lists, reading items, adding/removing items, and checking/unchecking items when API-style access is acceptable.

使用说明 (SKILL.md)

Bring Shopping

Name: Bring! Shopping List App (Unofficial)
Author: cutzenfriend

Overview

Use the bring-shopping npm package to access Bring! lists with email/password credentials. Default list is "Willig" unless the user specifies otherwise.

Quick Start

Install dependency in the skill folder:
- npm install bring-shopping
Set environment variables in the Clawdbot config (preferred) or shell:
- BRING_EMAIL and BRING_PASSWORD
Run the CLI script:
- node scripts/bring_cli.mjs items --list "Willig"

Tasks

Show lists

node scripts/bring_cli.mjs lists

Show items

node scripts/bring_cli.mjs items --list "Willig"

Add items

node scripts/bring_cli.mjs add --item "Milch" --spec "2L" --list "Willig"

Remove items

node scripts/bring_cli.mjs remove --item "Milch" --list "Willig"

Check items

node scripts/bring_cli.mjs check --item "Milch" --list "Willig"

Uncheck items

node scripts/bring_cli.mjs uncheck --item "Milch" --spec "2L" --list "Willig"

Notes

Store credentials in Clawdbot config env so they are not bundled with the skill.
If the list name is ambiguous, run lists and ask which list to use.
If an item is already checked, uncheck re-adds it to the purchase list.

安全使用建议

Before installing: verify the npm 'bring-shopping' package is trustworthy (check the npm page, repository, release date, and maintainers); prefer an API token or app-specific credential rather than your primary Bring! password if possible; be aware the SKILL.md and script require BRING_EMAIL/BRING_PASSWORD but the registry metadata did not declare them — treat that as a red flag and ask the publisher to correct it; review the bring_cli.mjs code (it is short and only prints JSON to stdout) and consider running it in a sandbox or with a throwaway account first. If you must use your real account, limit the skill to user-invoked use and avoid giving it always-on/autonomous invocation until you trust the package and credential handling.

功能分析

Type: OpenClaw Skill Name: bring-shopping Version: 1.0.0 The skill is designed to manage Bring! shopping lists using the `bring-shopping` Node.js library. It securely retrieves credentials (`BRING_EMAIL`, `BRING_PASSWORD`) from environment variables as recommended in `SKILL.md` and uses them solely for authenticating with the Bring! API. The `scripts/bring_cli.mjs` file implements the stated functionality without any evidence of data exfiltration, malicious execution, persistence, or prompt injection attempts against the agent. All actions are directly related to the skill's stated purpose.

能力评估

ℹ Purpose & Capability

The name/description and the included CLI script align: it uses the unofficial bring-shopping Node.js library to list and modify Bring! lists. However, the skill metadata declares no required environment variables or primary credential even though the README and script require BRING_EMAIL and BRING_PASSWORD — that's an inconsistency that should have been declared.

ℹ Instruction Scope

SKILL.md limits runtime actions to installing the bring-shopping npm package, reading BRING_EMAIL/BRING_PASSWORD, and running scripts that call the Bring API. The instructions do not ask the agent to read unrelated files or exfiltrate data to third-party endpoints. They do instruct you to store raw email/password in the agent config, which is sensitive and should be considered carefully.

⚠ Install Mechanism

There is no formal install spec — the SKILL.md tells the operator to run `npm install bring-shopping` in the skill folder. That means at runtime someone (or an automated process) will fetch code from the npm registry; this is a moderate supply-chain risk and should be reviewed (verify the package source, version, and maintainers). The skill itself does not bundle the bring-shopping dependency.

⚠ Credentials

The script requires BRING_EMAIL and BRING_PASSWORD to log in, but the skill metadata does not declare these required env vars or a primary credential. Requesting a user email and password is proportionate to the stated purpose, but storing raw passwords is sensitive — the metadata omission and lack of explicit primaryEnv are problematic and increase risk of accidental credential exposure.

✓ Persistence & Privilege

The skill is not always-included and does not request elevated platform privileges. It does suggest storing credentials in the Clawdbot config but does not modify system or other skills' configs. Autonomous invocation is enabled by default (standard) but not combined with other high-risk flags.

版本历史

v1.0.0

- Initial release of the bring-shopping skill. - Manage Bring! shopping lists using the unofficial bring-shopping Node.js library. - Supports listing shopping lists, reading, adding, removing, checking, and unchecking items via CLI. - Authenticates with Bring! using email and password; credentials should be stored in environment variables. - Defaults to the "Willig" list unless otherwise specified.

元数据

Slug bring-shopping

版本 1.0.0

许可证 —

累计安装 6

当前安装数 6

历史版本数 1

常见问题

Bring! Shopping List App (Unofficial) 是什么？

Manage Bring! shopping lists via the unofficial bring-shopping Node.js library using email/password login. Use for listing lists, reading items, adding/removing items, and checking/unchecking items when API-style access is acceptable. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 2371 次。

如何安装 Bring! Shopping List App (Unofficial)？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install bring-shopping」即可一键安装，无需额外配置。

Bring! Shopping List App (Unofficial) 是免费的吗？

是的，Bring! Shopping List App (Unofficial) 完全免费（开源免费），可自由下载、安装和使用。

Bring! Shopping List App (Unofficial) 支持哪些平台？

Bring! Shopping List App (Unofficial) 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Bring! Shopping List App (Unofficial)？

由 cutzenfriend（@cutzenfriend）开发并维护，当前版本 v1.0.0。

Bring! Shopping List App (Unofficial)