Definitely not a wildcard, such things are not allowed. You can fetch at evaluation time with the built-in fetchers (builtins.fetchgit, builtins.fetchTarball, etc) and not provide a hash, which makes the expression "impure", which means the expression wouldn't be acceptable in nixpkgs and it has consequences for flakes.