Nadfun Skill

• Analyzed: May 12, 2026, 3:23 AM
• Findings: 1
• Version: 0.1.0
• Hash: 0b64cb36ee1492880f3fd8463c3f241df98319641db2edf2a1d804679418e857
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its direct access and utilization of `process.env.PRIVATE_KEY` as shown in the `skill.md` file. While this is necessary for its stated purpose of blockchain interaction and token trading, handling private keys represents a significant high-risk capability. The skill uses this private key to initialize a `walletClient` and to sign messages for authentication with external APIs (e.g., `dev-api.nad.fun`, `api.nadapp.net`), which, if compromised, could lead to unauthorized financial transactions or credential misuse. There is no clear evidence of intentional malicious behavior or prompt injection in the provided content, but the inherent risk associated with private key management warrants a 'suspicious' classification.