Nadfun Skill

Launch, trade, and monitor Monad blockchain tokens using bonding curves, permit signatures, and on-chain event queries with viem integration.

Do not install or run this skill until the author clarifies credential needs. Key concerns: (1) SKILL.md reads process.env.PRIVATE_KEY and signs messages — that gives full transaction authority for the associated wallet; never put high-value private keys in an environment used by third-party skills without explicit trust and code review. (2) The metadata does not declare the PRIVATE_KEY or any credential requirement — ask the developer to update the registry metadata to list required env vars (e.g., PRIVATE_KEY) and explain exactly when signing is performed. (3) Prefer interactive signing (connect a hardware wallet or prompt the user) or ephemeral keys rather than storing a private key in agent env. (4) Verify the apiUrl/rpcUrl endpoints and the project origin (nad.fun / nadapp.net) before using — confirm they are legitimate. If you must proceed, run the code in an isolated environment, audit network calls, and avoid exposing any high-value keys.

Type: OpenClaw Skill Name: nadfun-skill Version: 0.1.0 The skill is classified as suspicious due to its direct access and utilization of `process.env.PRIVATE_KEY` as shown in the `skill.md` file. While this is necessary for its stated purpose of blockchain interaction and token trading, handling private keys represents a significant high-risk capability. The skill uses this private key to initialize a `walletClient` and to sign messages for authentication with external APIs (e.g., `dev-api.nad.fun`, `api.nadapp.net`), which, if compromised, could lead to unauthorized financial transactions or credential misuse. There is no clear evidence of intentional malicious behavior or prompt injection in the provided content, but the inherent risk associated with private key management warrants a 'suspicious' classification.