AFOL BrickEconomy

PassAudited by VirusTotal on May 10, 2026.

Overview

Type: OpenClaw Skill Name: afol-brickeconomy Version: 1.0.0 The skill is a well-documented tool for LEGO set valuation and collection analysis using the BrickEconomy API. The Python CLI (scripts/brickeconomy_cli.py) uses standard libraries, implements proper URL encoding for path segments, and correctly handles authentication via environment variables. The instructions in SKILL.md and the prompt guidance in references/prompts/brickeconomy-tools.txt are aligned with the stated purpose and include explicit safety warnings regarding data privacy and API key handling.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If installed and configured with an API key, the agent can retrieve private BrickEconomy collection values, paid prices, sale records, fees, dates, and notes when asked.

Why it was flagged

The skill requires a BrickEconomy API key and can access authenticated personal collection and sales-ledger data. This is purpose-aligned and disclosed, but it is sensitive account/financial information.

Skill content
Required environment variable: export BRICKECONOMY_API_KEY=... ... Treat returned collection and sales-ledger data as private financial/account data.
Recommendation

Only configure the API key if you are comfortable sharing BrickEconomy account data with the agent, and ask for summaries or scoped analysis when you do not want full details returned.

NoteMedium Confidence
ASI01: Agent Goal Hijack
What this means

An agent that over-trusts this reference could try to use unavailable or external pricing tools instead of the included BrickEconomy CLI.

Why it was flagged

This reference prompt gives broader tool-use instructions involving a separate LegoTools/BrickLink fallback that is not implemented by the included CLI and is narrower in SKILL.md, which says not to use other providers unless the user explicitly asks.

Skill content
ALWAYS use bd_get_price for price inquiries about specific items ... Automatic fallback: Tries BrickEconomy first → Falls back to BrickLink if unavailable
Recommendation

Treat SKILL.md as authoritative: use the included CLI for BrickEconomy queries, and only use BrickLink or other fallback providers when the user explicitly requests multi-provider lookup.

What this means

The documented command may fail unless the user invokes the Python script directly or adds a wrapper.

Why it was flagged

The file manifest provides scripts/brickeconomy_cli.py but not a scripts/brickeconomy wrapper, and there is no install spec that creates one. This looks like a packaging/documentation mismatch rather than hidden code.

Skill content
Primary interface: `scripts/brickeconomy`.
Recommendation

Verify the actual command path before use, for example by running the provided Python file directly if no scripts/brickeconomy wrapper exists.