NadName Agent
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Node.js scripts to interact with the Monad blockchain. It manages sensitive credentials (private keys) securely by supporting environment variables or locally stored AES-256-GCM encrypted keystores, avoiding hardcoded secrets.
- [DATA_EXPOSURE]: The scripts read and write configuration and wallet data to a hidden directory (
~/.nadname) within the user's home folder. The skill implements restrictive file permissions (chmod 600and700) for these files to prevent unauthorized local access. - [EXTERNAL_DOWNLOADS]: The scripts make network requests to the official Nad Name Service API (
api.nad.domains) and the Monad blockchain RPC (rpc.monad.xyz). These operations are necessary for checking name availability and submitting registration transactions. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided names via command-line arguments. It includes a validation function that sanitizes input against a specific whitelist of characters (alphanumeric, hyphens, and certain Unicode scripts/emojis), reducing the risk of processing malicious payloads.
Audit Metadata