BrickEconomy

PassAudited by VirusTotal on May 10, 2026.

Overview

Type: OpenClaw Skill Name: brickeconomy Version: 1.0.0 The brickeconomy skill bundle is a well-documented and safe interface for interacting with the BrickEconomy API. The Python CLI (scripts/brickeconomy_cli.py) uses only the standard library, implements proper URL encoding for parameters, and restricts operations to read-only GET requests as defined in the provided OpenAPI specification. The instructions in SKILL.md and the prompt guidance emphasize security best practices, such as protecting API keys and respecting user data privacy.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill can act with the user's BrickEconomy API access and retrieve account-specific data.

Why it was flagged

The skill requires a BrickEconomy API key even though the registry metadata says no required env vars or primary credential; the key is expected for this API, but users should notice the credential requirement.

Skill content
Required environment variable:

```bash
export BRICKECONOMY_API_KEY=...
```
Recommendation

Declare BRICKECONOMY_API_KEY in metadata and use a least-privilege API key if BrickEconomy supports one.

What this means

Collection holdings, paid prices, sale prices, fees, dates, and notes may become visible in the chat context when the user requests portfolio or sales analysis.

Why it was flagged

The artifacts clearly disclose that collection and sales-ledger responses contain private financial/account information, and the CLI can print that data into the agent conversation.

Skill content
Treat returned collection and sales-ledger data as private financial/account data.
Recommendation

Only request collection or sales-ledger analysis when needed, and avoid sharing transcripts containing private financial data.

NoteMedium Confidence
ASI01: Agent Goal Hijack
What this means

For pricing requests, an agent might try to route lookups through another LEGO pricing tool or provider if available, rather than only using this skill's CLI.

Why it was flagged

This bundled reference tells the agent to use an external tool and fallback provider not included in this skill, which is broader than SKILL.md's stated primary interface of the included BrickEconomy CLI.

Skill content
ALWAYS use bd_get_price for price inquiries about specific items
- Automatic fallback: Tries BrickEconomy first → Falls back to BrickLink if unavailable
Recommendation

Remove or soften the cross-tool 'ALWAYS' guidance unless the dependency and data flow are explicitly declared and intended.

What this means

The skill may not run exactly as documented without an additional wrapper or manual invocation of the Python file.

Why it was flagged

The manifest lists scripts/brickeconomy_cli.py but not a scripts/brickeconomy wrapper, so the documented command may be missing from the reviewed archive.

Skill content
Primary interface: `scripts/brickeconomy`.
Recommendation

Include the referenced wrapper or update SKILL.md to call scripts/brickeconomy_cli.py directly.