alchemy-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides educational content on Web3 security, specifically teaching how to avoid common vulnerabilities like hardcoded credentials and unsafe input handling.
- [DATA_EXPOSURE]: The instructions promote safe credential handling by advising the use of server-side environment variables and dedicated secret management services such as Google Cloud Secret Manager, while explicitly warning against client-side exposure.
- [INDIRECT_PROMPT_INJECTION]: The skill addresses an attack surface where external data (blockchain addresses, block numbers) is processed. It implements a mitigation strategy consisting of: (1) Ingestion points defined in proxy route parameters in
SKILL.md; (2) Boundary markers including explicit validation checks; (3) Capabilities restricted to read-only blockchain queries; (4) Sanitization enforced via regex and theetherslibrary checksumming utilities. - [EXTERNAL_DOWNLOADS]: The skill references well-known and trusted libraries and services from established providers, including Alchemy and Google Cloud, which are standard for the described use case.
Audit Metadata