alchemy-cli

SUSPICIOUS. The core install source and primary data flows are consistent with an official Alchemy CLI skill, so this is not confirmed malware. However, the skill has a large and high-impact footprint: it can reveal stored secrets, persist API keys into project files, install additional skills, and perform autonomous financial/onchain actions plus third-party x402 payments. Those capabilities fit the stated blockchain-admin purpose but materially raise security risk beyond a normal documentation or query-only skill.