alchemy-agentic-gateway

SUSPICIOUS: the skill is internally coherent and appears same-org/official, so it is not malware. However, it grants an AI agent financial-action capability, relies on raw wallet/private-key handling, and forwards payment/auth credentials through external CLIs/libraries and network requests; this makes it materially risky despite fitting its stated purpose.

The code describes legitimate automatic payment handling and contains no clear malicious behavior. The main security concern is the sample /api/create-spt endpoint: without authentication and strict server-side validation, it could be abused to create Stripe payment tokens or incur unauthorized payment activity. The endpoint should be restricted, validate all parameters against server-controlled policy, use production Stripe APIs only in production, and protect wallet and Stripe credentials.

The fragment is gateway integration documentation, not malware or executable code. It presents significant operational and supply-chain concerns because it handles private keys, controls wallet payments, recommends unpinned `npx` execution, and supports automatic payment retries. No direct malicious behavior is demonstrated in the supplied text; inspect the exact package version, dependencies, signatures, and key-storage implementation before use.