alchemy-prod-checklist
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides a comprehensive checklist and a TypeScript validation script for Web3 deployments. The script verifies connectivity to Alchemy's official APIs using the alchemy-sdk library and performs a security scan of the build directory to prevent API key leakage.
- [INDIRECT_PROMPT_INJECTION]: The validation script identifies a potential ingestion surface by reading local build artifacts. 1. Ingestion points: Reads all .js files within the ./dist directory (defined in SKILL.md). 2. Boundary markers: None present to distinguish between trusted instructions and data from the scanned files. 3. Capability inventory: The script performs file system reads (fs.readFileSync) and outputs results to the console; it does not perform network operations based on the ingested data. 4. Sanitization: No sanitization of the file content is performed; it is treated as a raw string for comparison against an environment variable.
Audit Metadata