Shopping List

Conversational shopping list with categories, family sharing, and purchase history. Add items, check them off, organize by category — all through natural lan...

This skill appears to do exactly what it says: keep a local shopping list and history in skills/shopping-list/data/. Before installing, consider: (1) it will create and modify files in that directory and persist a chosen user name in data/config.json; (2) ensure you are comfortable storing shopping data locally in the agent environment; (3) the skill assumes the agent has permission to read/write the specified relative path and will rename corrupted active.json to active.json.corrupt — if you have sensitive files under a similarly named path, check where the agent's working directory is. There are no network calls, no credentials requested, and no install-time downloads. If you want to be extra cautious, inspect the data/ files after first use to confirm contents and location.

Type: OpenClaw Skill Name: shopping-list Version: 1.0.1 The skill is classified as suspicious due to the explicit instruction in `SKILL.md` to execute a shell command (`uuidgen` in bash) for generating IDs. While `uuidgen` itself is a benign utility, this direct instruction for shell execution represents a risky capability and a potential shell injection vulnerability if the agent's execution environment is not robustly sandboxed or if future skill versions introduce user-controlled arguments to such commands. There is no evidence of intentional malicious behavior like data exfiltration or persistence.