Skills heurist-mesh-skill
๐Ÿ“ฆ

heurist-mesh-skill

Content revision r1 Critical ๐ŸŒ Network access๐Ÿ”‘ Env variablesโš™๏ธ External commands๐Ÿ“ Filesystem access

Analyze Crypto Markets with Heurist Mesh

Crypto research needs live token, wallet, DeFi, and social data from many sources. This skill guides Claude, Codex, and Claude Code to query Heurist Mesh agents through documented API flows.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "heurist-mesh-skill" from https://skillstore.io/skills/internet-court-heurist-mesh-skill.md and its manifest at https://skillstore.io/api/skills/internet-court-heurist-mesh-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Test it

Using "heurist-mesh-skill". What tokens are trending right now?

Expected outcome:

A ranked token brief with volume, social attention, recent price movement, and caveats about volatility.

Using "heurist-mesh-skill". Compare Uniswap and Aave activity this week.

Expected outcome:

A protocol comparison covering TVL, fees, revenue, chain coverage, growth direction, and notable differences.

Using "heurist-mesh-skill". Review this wallet for major holdings and labels.

Expected outcome:

A wallet summary with token balances, NFT collections, address labels, estimated value, and risk notes.

Security Audit

Critical
v2 โ€ข 7/21/2026 Open versioned report

The skill documents legitimate cryptocurrency research and paid API access, but it handles API keys and wallet private keys. It also includes a remote installer piped to bash, an unsafe installation pattern, and a payment flow that can authorize USDC transfers. Most shell-backtick and reconnaissance detections are Markdown or descriptive false positives.

6
Files scanned
499
Lines analyzed
17
Review items
0
False positives ignored

Confirmed security concerns (14)

Critical
Pipe to shell pattern
curl -L https://foundry.paradigm.xyz | bash
The documentation instructs users to pipe a remotely fetched installer directly into bash. A compromised or substituted download would execute arbitrary code without inspection.
Critical
Pipe to shell pattern
- `cast` from Foundry (`curl -L https://foundry.paradigm.xyz | bash && foundryup`)
The documentation instructs users to pipe a remotely fetched installer directly into bash. A compromised or substituted download would execute arbitrary code without inspection.
High
Environment file access
Store in `.env`:
No evidence was found to safely dismiss the detected pattern; it is retained for review.
High
Environment file access
Save from response: `data.userId` and `data.privateKey` into `.env`.
The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.
High
Crypto seed/private key mention
Save from response: `data.userId` and `data.privateKey` into `.env`.
The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.
High
Crypto seed/private key mention
"privateKey":"<INFLOW_PRIVATE_KEY>",
The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.
High
Crypto seed/private key mention
Pay per tool call with USDC on Base. No account needed โ€” just a private key with USDC balance and `c
The workflow requires a wallet private key to derive an address and sign a USDC payment authorization. This is sensitive financial capability and requires explicit user control.
High
Crypto seed/private key mention
- Private key with USDC balance on Base
The workflow requires a wallet private key to derive an address and sign a USDC payment authorization. This is sensitive financial capability and requires explicit user control.
Show all 14 confirmed findings
High
Environment file access
- **API key (recommended):** Set `HEURIST_API_KEY` in `.env`. Setup and free-credit flow: [reference
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
Environment file access
- **x402 on Base:** Set `WALLET_PRIVATE_KEY` in `.env`. Signed payment flow: [references/x402-paymen
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
Environment file access
- **Inflow:** Set `INFLOW_USER_ID` and `INFLOW_PRIVATE_KEY` in `.env`. Buyer setup and approval flow
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
Environment file access
### Step 2: Verify setup in `.env`
No evidence was found to safely dismiss the detected pattern; it is retained for review.
High
Environment file access
- `401`/`403`: Treat as credential issue; ask user to re-check `.env` values and do not continue cal
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
Unbounded Cryptocurrency Payment Authorization
The x402 flow obtains payment metadata, signs a USDC transfer authorization with a wallet private key, and submits it without requiring a separate confirmation of recipient and amount.
The documented sequence explicitly receives payment terms, creates an EIP-712 transfer authorization, signs it with a private key, and sends the payment header. This enables real financial transactions.
Capability review items (17)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Generic API/secret keys
4. Returns `api_key`, `credits` (100), and `twitter_handle`. One claim per Twitter handle. Code expi
The documentation provisions and uses an API key for authenticated Mesh requests. The key is sensitive and should be scoped and handled only with user approval.
High
Generic API/secret keys
Authorization: Bearer <api_key>
The documentation provisions and uses an API key for authenticated Mesh requests. The key is sensitive and should be scoped and handled only with user approval.
High
Generic API/secret keys
INFLOW_PRIVATE_KEY=your-buyer-private-key
The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.
High
Generic API/secret keys
"privateKey":"<INFLOW_PRIVATE_KEY>",
The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.
High
Generic API/secret keys
curl -sS -H "X-API-Key: $INFLOW_PRIVATE_KEY" \
The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.
High
Generic API/secret keys
WALLET=$(cast wallet address --private-key "$PRIVATE_KEY")
The workflow requires a wallet private key to derive an address and sign a USDC payment authorization. This is sensitive financial capability and requires explicit user control.
High
Generic API/secret keys
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
The workflow requires a wallet private key to derive an address and sign a USDC payment authorization. This is sensitive financial capability and requires explicit user control.
High
Generic API/secret keys
- **API key (recommended):** Set `HEURIST_API_KEY` in `.env`. Setup and free-credit flow: [reference
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
Generic API/secret keys
- **x402 on Base:** Set `WALLET_PRIVATE_KEY` in `.env`. Signed payment flow: [references/x402-paymen
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
Generic API/secret keys
- **Inflow:** Set `INFLOW_USER_ID` and `INFLOW_PRIVATE_KEY` in `.env`. Buyer setup and approval flow
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
Generic API/secret keys
- API key path: `HEURIST_API_KEY` is set and non-empty
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
Generic API/secret keys
- x402 path: `WALLET_PRIVATE_KEY` is set, starts with `0x`, and is 66 characters
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
Generic API/secret keys
- Inflow path: `INFLOW_USER_ID` and `INFLOW_PRIVATE_KEY` are set and non-empty
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
Generic API/secret keys
-H "Authorization: Bearer $HEURIST_API_KEY" \
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
Generic API/secret keys
- `402`: Payment required; follow the selected payment path (`HEURIST_API_KEY`, x402 flow, or Inflow
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
Medium
Temp directory access
cat > /tmp/eip712.json << EOF
The payment workflow writes a predictable file in /tmp before signing it. Another local process can race or replace that path, changing the signed payload or causing an unintended file overwrite.
Medium
Temp directory access
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
The payment workflow writes a predictable file in /tmp before signing it. Another local process can race or replace that path, changing the signed payload or causing an unintended file overwrite.

Risk Factors

๐ŸŒ Network access (17)
๐Ÿ”‘ Env variables (15)
โš™๏ธ External commands (49)
๐Ÿ“ Filesystem access (2)

Detected Patterns

Pipe to shell patternร—2
Audited by: claude View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/internet-court-heurist-mesh-skill/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-heurist-mesh-skill/security.svg)](https://skillstore.io/skills/internet-court-heurist-mesh-skill?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-heurist-mesh-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-heurist-mesh-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-heurist-mesh-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

internet-court. (2026). heurist-mesh-skill security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-heurist-mesh-skill/audits/2

BibTeX citation

@techreport{internet-court-internet-court-heurist-mesh-skill-2026, author = {internet-court}, title = {heurist-mesh-skill security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/internet-court-heurist-mesh-skill/audits/2}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "heurist-mesh-skill security audit report (audit version 2)" version: "unspecified" type: report authors: - name: "internet-court" date-released: "2026-07-21" url: "https://skillstore.io/skills/internet-court-heurist-mesh-skill/audits/2" identifiers: - type: other value: "skillstore:internet-court-heurist-mesh-skill:audit:2" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
59
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Monitor Token Momentum

Track trending tokens, market summaries, and notable social signals before preparing a market brief.

Compare Protocol Metrics

Review TVL, fees, revenue, chain coverage, and growth trends across DeFi protocols.

Investigate Wallet Activity

Summarize wallet holdings, NFT collections, address labels, and related project context.

Try These Prompts

Check Trending Tokens
Use Heurist Mesh to show tokens trending now. Include the agent used, key metrics, and a short risk note.
Research a Token Profile
Resolve [TOKEN] with TokenResolverAgent, fetch its profile, and summarize market pairs, indicators, and funding data.
Compare DeFi Protocols
Fetch current metrics for [PROTOCOL A] and [PROTOCOL B]. Compare TVL, fees, chains, revenue, and recent growth.
Build a Multi-Agent Market Brief
Discover the best Heurist Mesh agents for [MARKET QUESTION]. Fetch schemas, run only necessary paid calls, and produce a sourced brief.

Best Practices

  • Fetch the current agent schema before each new workflow.
  • Confirm pricing, credentials, and payment method before any paid API call.
  • Ask the user to disambiguate tokens, wallets, or projects before expensive follow-up calls.

Avoid

  • Do not expose API keys or private keys in chat, logs, or shared files.
  • Do not make paid calls before setup, pricing, and user intent are clear.
  • Do not treat agent research output as investment advice.

Frequently Asked Questions

What does this skill connect to?
It connects to Heurist Mesh agents for crypto market, wallet, DeFi, social, and project research data.
Does it require payment?
Yes. Calls require credits, x402 payment, or Inflow approval, depending on the selected path.
Can it work without network access?
No. The skill depends on live external API calls to retrieve current data.
Can Claude Code or Codex use it?
Yes. The skill lists support for Claude, Codex, and Claude Code.
Does it store private keys safely?
The source documents .env storage, which requires caution. Use safer secret storage when possible.
Is the output financial advice?
No. Outputs are research summaries and should be reviewed before making financial decisions.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Ref

3f6e026a3363e0954ede7bef0cfe88d4475de137

Maintenance freshness

7/21/2026

Usage

1 downloads ยท 0 views

File structure

๐Ÿ“ references/

๐Ÿ“„ discover-agents.md

๐Ÿ“„ heurist-api-key.md

๐Ÿ“„ inflow-payment.md

๐Ÿ“„ x402-payment.md

๐Ÿ“„ README.md

๐Ÿ“„ SKILL.md

More from internet-court

View all
View all