alchemy-openapi-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited alchemy-openapi-skill (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to run Alchemy Prices API operations through uxc + OpenAPI.
Reuse the uxc skill for shared execution, auth, and error-handling guidance.
uxc is installed and available in PATH.https://api.g.alchemy.com.https://raw.githubusercontent.com/holon-run/uxc/main/skills/alchemy-openapi-skill/references/alchemy-prices.openapi.jsonThis v1 skill intentionally covers the narrow Prices API surface:
This skill does not cover:
uxc callAlchemy Prices API places the API key in the request path: /prices/v1/{apiKey}/....
Configure one API-key credential with a request path prefix template:
uxc auth credential set alchemy-prices \
--auth-type api_key \
--secret-env ALCHEMY_API_KEY \
--path-prefix-template "/prices/v1/{{secret}}"
uxc auth binding add \
--id alchemy-prices \
--host api.g.alchemy.com \
--scheme https \
--credential alchemy-prices \
--priority 100Validate the active mapping when auth looks wrong:
uxc auth binding match https://api.g.alchemy.comcommand -v alchemy-openapi-cliuxc link alchemy-openapi-cli https://api.g.alchemy.com --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/alchemy-openapi-skill/references/alchemy-prices.openapi.json
alchemy-openapi-cli -halchemy-openapi-cli get:/tokens/by-symbol -halchemy-openapi-cli post:/tokens/by-address -halchemy-openapi-cli post:/tokens/historical -halchemy-openapi-cli get:/tokens/by-symbol symbols=ETH currency=USDalchemy-openapi-cli post:/tokens/by-address '{"addresses":[{"network":"eth-mainnet","address":"0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48"}],"currency":"USD"}'alchemy-openapi-cli post:/tokens/historical '{"symbol":"ETH","startTime":"2025-01-01T00:00:00Z","endTime":"2025-01-07T00:00:00Z","interval":"1d","currency":"USD"}'get:/tokens/by-symbolpost:/tokens/by-addresspost:/tokens/historical--text.ok, kind, protocol, data, error.--secret-env or --secret-op, not shell history literals, when possible./tokens/by-symbol is query-based in the live API.symbols= parameters, but this v1 skill intentionally narrows that endpoint to a single symbols=<TOKEN> query because current uxc query argument handling does not reliably execute array-shaped query parameters.alchemy-openapi-cli <operation> ... is equivalent to uxc https://api.g.alchemy.com --schema-url <alchemy_openapi_schema> <operation> ....references/usage-patterns.mdreferences/alchemy-prices.openapi.json~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.