alchemy-api
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate developer documentation for Alchemy's blockchain infrastructure. All external network endpoints are directed to official vendor-owned domains (alchemy.com, alchemyapi.io).
- [SAFE]: Credential management instructions emphasize security by advising the agent to persist API keys to .env files while ensuring they are excluded from version control via .gitignore.
- [SAFE]: Webhook integration guides include mandatory cryptographic signature verification (HMAC-SHA256) to ensure the integrity and authenticity of incoming blockchain data.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted blockchain data (e.g., transaction logs and traces), which represents a vulnerability surface for indirect prompt injection. However, the documentation provides appropriate remediation guidance through signature verification and input validation.
Audit Metadata