alchemy-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions specify installing alchemy-sdk from the npm registry, which is the official library for the Alchemy platform.- [INDIRECT_PROMPT_INJECTION]: The example code processes metadata from the Ethereum blockchain, such as NFT titles and ERC-20 token symbols, which originate from untrusted external sources.
- Ingestion points: alchemy.nft.getNftsForOwner and alchemy.core.getTokenMetadata in SKILL.md examples.
- Boundary markers: Absent; the code prints retrieved metadata directly to the terminal.
- Capability inventory: The skill environment has Write, Edit, and Bash capabilities available.
- Sanitization: Absent; the provided examples do not demonstrate validation or sanitization of the retrieved blockchain strings.
Audit Metadata