alchemy-install-auth
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
alchemy-sdkpackage from official registries (npm and pip). These are standard libraries used for interacting with Alchemy's blockchain infrastructure. The Python version is identified as a community-supported SDK. - [COMMAND_EXECUTION]: Shell commands are utilized for package installation and environment configuration. The skill correctly uses quoted heredocs (
'EOF') when creating the.envfile to prevent unintended shell expansion and ensures that the sensitive configuration file is added to.gitignoreto prevent credential exposure. - [INDIRECT_PROMPT_INJECTION]: The skill implements a connection verification step that retrieves the latest block number from the Alchemy API. This involves processing data from an external blockchain source within the agent's context.
- Ingestion points:
alchemy.core.getBlockNumber()call inSKILL.md. - Boundary markers: Not applicable for this specific numeric data point.
- Capability inventory: Package installation, file writing for local configuration, and network communication with Alchemy RPC endpoints.
- Sanitization: The data processed is a numeric block height, which is a low-complexity data type that poses minimal risk of tool output poisoning.
Audit Metadata