Security audit
Security checks for vulnerabilities and agentic risk
This skill is for a paid blockchain Wordle game, but it can have an agent handle wallet keys and spend tokens without enough guardrails.
Use only with a dedicated low-balance wallet, never a primary wallet private key. Treat WORDLE purchases, approvals, and playGame calls as real irreversible blockchain transactions; confirm each one manually, approve only the minimum needed, and revoke allowances when finished.
The skill requires users to buy tokens, approve a contract, and spend tokens on-chain, yet it does not prominently warn that approvals and purchases are irreversible and can expose wallet funds. Missing spend-risk disclosure is dangerous in an agent context because users may not realize they are authorizing real blockchain transactions rather than ordinary game API calls.
The skill claims to enable Wordle gameplay, but it embeds direct private-key wallet setup and token-purchase logic that can cause an agent to execute irreversible financial transactions far beyond simple game-state retrieval. This broadens the capability surface from a game client into an automated on-chain trader/spender, increasing the chance of unsafe key handling, accidental token purchases, approvals, and fund loss.
The manifest describes a Wordle game skill, but the file includes broader nad.fun token-trading infrastructure and router interaction details unrelated to core gameplay. Hidden or under-disclosed expansion of scope is dangerous because an agent or user may invoke trading behavior they did not intend, exposing funds to slippage, routing risk, or maliciously substituted contract parameters.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Example:
curl -X POST https://wordle.nadnation.xyz/api/game/start \
-H "Content-Type: application/json" \
-d '{
"address": "0x1234567890abcdef1234567890abcdef12345678",
No suspicious patterns detected.