alchemy-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues detected. The skill outlines a secure lifecycle for blockchain event delivery, emphasizing mandatory signature verification and separation of credentials.
- [EXTERNAL_DOWNLOADS]: The skill references official documentation and resources from Alchemy (alchemy.com), which is a well-known infrastructure provider in the blockchain space. These references are used for configuration and guidance purposes.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data from Alchemy webhooks, creating a potential surface for indirect injection. However, it explicitly mitigates this risk through mandatory security protocols.
- Ingestion points: Webhook request body captured for processing as described in
SKILL.md. - Boundary markers: The use of
X-Alchemy-Signaturefor verification acts as a strong boundary for authenticated data. - Capability inventory: File system access via Read, Glob, Grep, Write, and Edit tools as defined in the skill metadata.
- Sanitization: Strict raw-body HMAC-SHA256 signature verification using timing-safe functions is required before any data parsing or side effects occur.
Audit Metadata