Agent skill · security · jeremylongshore
alchemy-security-basics
Analyze and secure Alchemy credentials, browser access, wallet authority, webhook verification, and untrusted chain data. Use when securing an Alchemy-backed application. Trigger with "secure Alchemy", "Alchemy API key exposure", or "verify an Alchemy webhook".
Why this skill is useful
Provides specific security practices and code examples for securing Alchemy-powered Web3 applications that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Alchemy Credential and Trust-Boundary Security Overview Analyze and secure Alchemy credentials, browser access, wallet authority, webhook verification, and untrusted chain data. This workflow produces a reviewable artifact and negative-path evidence before any live side effect. Prerequisites Current first-party Alchemy documentation for the selected product, chain, feature, client, authentication method, limit, and lifecycle. Named product, application, security, data/privacy, budget, release, and operations owners appropriate to the requested scope. Synthetic or approved non-production fixtures, a credential canary, explicit success criteria, and a tested rollback boundary. Current Contract An Alchemy application key identifies and limits provider access but is not a wallet private key. Frontend use is not categorically forbidden: current guidance supports explicit allowlists and recommends short-lived JWTs where appropriate. Admin keys, Notify tokens, webhook signing keys, and transaction signing authority remain server-side and separately controlled. Authentication Create a credential matrix covering application keys, access keys, Admin access, Notify management, webhook verification, and wallet signers. Assign owner, storage, runtime, scopes/allowlists, rotation, revocation, monitoring, and incident procedure to each. Instructions 1. Map browser, edge, server, CI, webhook, admin, and wallet trust boundaries and the data crossing each boundary. 2. Choose server header auth for confidential workloads; if browser access is justified, apply exact allowlists or short-lived JWTs and test bypass conditions. 3. Validate chain IDs, addresses, block selectors, contract ABIs, method allowlists, response sizes, and remote NFT metadata before use. 4. Keep read clients separate from signers; require explicit transaction simulation, user intent, policy checks, and approval in a distinct workflow. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/alchemy-security-basics