alchemy
Warn
Audited by Snyk on Mar 4, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill instructs the agent to fetch and run Alchemy actions (e.g., "Get NFT Metadata", "Get Contract Metadata") and to proxy arbitrary Alchemy API requests via "membrane request", which pulls public/open blockchain and OpenSea NFT metadata (user-generated content) that the agent is expected to read and could materially influence subsequent decisions or tool use.
Audit Metadata