monad-wordle-game

clawhub:monad-wordle-game

View source
A
100/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

2

Score

100/100

LOW 2

Findings (2)

LOW
Mutable GitHub raw content reference
L77

Detects references to raw.githubusercontent.com on mutable branches like main/master

github.com/husseinrasti/monad-wordle/blob/main/contract/abi.json)
FIX

Replace GitHub raw.githubusercontent.com references with pinned commit SHAs instead of branch names (e.g., /commit-sha/file instead of /main/file). Branch references are mutable.

FP?

Likely FP if the raw GitHub URL points to a versioned release tag in a well-known repository, though even tags are technically mutable.

LOW
Runtime URL controlling behavior
L143

Detects URLs fetched at runtime that control or influence agent behavior without pinning

Read Smart contract ABIs: https:// + CONFIG
FIX

Avoid loading configuration or behavior-controlling content from runtime URLs. Bundle required configurations locally or pin remote config to versioned, integrity-verified endpoints.

FP?

Likely FP if the URL in the match is a documentation link or example URL (e.g., example.com) rather than an actual runtime-fetched configuration endpoint.