Skills heurist-mesh-skill

📦

heurist-mesh-skill

Name: heurist-mesh-skill
Author: internet-court

Content revision r1 Critical 🌐 Network access🔑 Env variables⚙️ External commands📁 Filesystem access

Analyze Crypto Markets with Heurist Mesh

Crypto research needs live token, wallet, DeFi, and social data from many sources. This skill guides Claude, Codex, and Claude Code to query Heurist Mesh agents through documented API flows.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "heurist-mesh-skill" from https://skillstore.io/skills/internet-court-heurist-mesh-skill.md and its manifest at https://skillstore.io/api/skills/internet-court-heurist-mesh-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/internet-court-heurist-mesh-skill.md Signed manifest GET /api/skills/internet-court-heurist-mesh-skill/manifest Signed lockfile GET /api/skills/internet-court-heurist-mesh-skill/lockfile

Test it

Using "heurist-mesh-skill". What tokens are trending right now?

Expected outcome:

A ranked token brief with volume, social attention, recent price movement, and caveats about volatility.

Using "heurist-mesh-skill". Compare Uniswap and Aave activity this week.

Expected outcome:

A protocol comparison covering TVL, fees, revenue, chain coverage, growth direction, and notable differences.

Using "heurist-mesh-skill". Review this wallet for major holdings and labels.

Expected outcome:

A wallet summary with token balances, NFT collections, address labels, estimated value, and risk notes.

Security Audit

Critical

v2 • 7/21/2026 Open versioned report

The skill documents legitimate cryptocurrency research and paid API access, but it handles API keys and wallet private keys. It also includes a remote installer piped to bash, an unsafe installation pattern, and a payment flow that can authorize USDC transfers. Most shell-backtick and reconnaissance detections are Markdown or descriptive false positives.

Files scanned

499

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (14)

Critical

references/x402-payment.md:8

Pipe to shell pattern

curl -L https://foundry.paradigm.xyz | bash

The documentation instructs users to pipe a remotely fetched installer directly into bash. A compromised or substituted download would execute arbitrary code without inspection.

Critical

references/x402-payment.md:123

Pipe to shell pattern

- `cast` from Foundry (`curl -L https://foundry.paradigm.xyz | bash && foundryup`)

The documentation instructs users to pipe a remotely fetched installer directly into bash. A compromised or substituted download would execute arbitrary code without inspection.

High

references/inflow-payment.md:7

Environment file access

Store in `.env`:

No evidence was found to safely dismiss the detected pattern; it is retained for review.

High

references/inflow-payment.md:25

Environment file access

Save from response: `data.userId` and `data.privateKey` into `.env`.

The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.

High

references/inflow-payment.md:25

Crypto seed/private key mention

Save from response: `data.userId` and `data.privateKey` into `.env`.

The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.

High

references/inflow-payment.md:35

Crypto seed/private key mention

"privateKey":"<INFLOW_PRIVATE_KEY>",

The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.

High

references/x402-payment.md:3

Crypto seed/private key mention

Pay per tool call with USDC on Base. No account needed — just a private key with USDC balance and `c

The workflow requires a wallet private key to derive an address and sign a USDC payment authorization. This is sensitive financial capability and requires explicit user control.

High

references/x402-payment.md:121

Crypto seed/private key mention

- Private key with USDC balance on Base

The workflow requires a wallet private key to derive an address and sign a USDC payment authorization. This is sensitive financial capability and requires explicit user control.

Show all 14 confirmed findings

High

SKILL.md:72

Environment file access

- **API key (recommended):** Set `HEURIST_API_KEY` in `.env`. Setup and free-credit flow: [reference

The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.

High

SKILL.md:73

Environment file access

- **x402 on Base:** Set `WALLET_PRIVATE_KEY` in `.env`. Signed payment flow: [references/x402-paymen

The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.

High

SKILL.md:74

Environment file access

- **Inflow:** Set `INFLOW_USER_ID` and `INFLOW_PRIVATE_KEY` in `.env`. Buyer setup and approval flow

The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.

High

SKILL.md:76

Environment file access

### Step 2: Verify setup in `.env`

No evidence was found to safely dismiss the detected pattern; it is retained for review.

High

SKILL.md:126

Environment file access

- `401`/`403`: Treat as credential issue; ask user to re-check `.env` values and do not continue cal

The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.

High

references/x402-payment.md:24-40 references/x402-payment.md:42-97

Unbounded Cryptocurrency Payment Authorization

The x402 flow obtains payment metadata, signs a USDC transfer authorization with a wallet private key, and submits it without requiring a separate confirmation of recipient and amount.

The documented sequence explicitly receives payment terms, creates an EIP-712 transfer authorization, signs it with a private key, and sends the payment header. This enables real financial transactions.

Capability review items (17)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/heurist-api-key.md:15

Generic API/secret keys

4. Returns `api_key`, `credits` (100), and `twitter_handle`. One claim per Twitter handle. Code expi

The documentation provisions and uses an API key for authenticated Mesh requests. The key is sensitive and should be scoped and handled only with user approval.

High

references/heurist-api-key.md:23

Generic API/secret keys

Authorization: Bearer <api_key>

The documentation provisions and uses an API key for authenticated Mesh requests. The key is sensitive and should be scoped and handled only with user approval.

High

references/inflow-payment.md:10

Generic API/secret keys

INFLOW_PRIVATE_KEY=your-buyer-private-key

The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.

High

references/inflow-payment.md:35

Generic API/secret keys

"privateKey":"<INFLOW_PRIVATE_KEY>",

The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.

High

references/inflow-payment.md:81

Generic API/secret keys

curl -sS -H "X-API-Key: $INFLOW_PRIVATE_KEY" \

The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.

High

references/x402-payment.md:45

Generic API/secret keys

WALLET=$(cast wallet address --private-key "$PRIVATE_KEY")

The workflow requires a wallet private key to derive an address and sign a USDC payment authorization. This is sensitive financial capability and requires explicit user control.

High

references/x402-payment.md:85

Generic API/secret keys

SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)

The workflow requires a wallet private key to derive an address and sign a USDC payment authorization. This is sensitive financial capability and requires explicit user control.

High

SKILL.md:72

Generic API/secret keys

- **API key (recommended):** Set `HEURIST_API_KEY` in `.env`. Setup and free-credit flow: [reference

The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.

High

SKILL.md:73

Generic API/secret keys

- **x402 on Base:** Set `WALLET_PRIVATE_KEY` in `.env`. Signed payment flow: [references/x402-paymen

The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.

High

SKILL.md:74

Generic API/secret keys

- **Inflow:** Set `INFLOW_USER_ID` and `INFLOW_PRIVATE_KEY` in `.env`. Buyer setup and approval flow

The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.

High

SKILL.md:78

Generic API/secret keys

- API key path: `HEURIST_API_KEY` is set and non-empty

The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.

High

SKILL.md:79

Generic API/secret keys

- x402 path: `WALLET_PRIVATE_KEY` is set, starts with `0x`, and is 66 characters

The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.

High

SKILL.md:80

Generic API/secret keys

- Inflow path: `INFLOW_USER_ID` and `INFLOW_PRIVATE_KEY` are set and non-empty

The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.

High

SKILL.md:99

Generic API/secret keys

-H "Authorization: Bearer $HEURIST_API_KEY" \

The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.

High

SKILL.md:127

Generic API/secret keys

- `402`: Payment required; follow the selected payment path (`HEURIST_API_KEY`, x402 flow, or Inflow

The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.

Medium

references/x402-payment.md:49

Temp directory access

cat > /tmp/eip712.json << EOF

The payment workflow writes a predictable file in /tmp before signing it. Another local process can race or replace that path, changing the signed payload or causing an unintended file overwrite.

Medium

references/x402-payment.md:85

Temp directory access

SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)

The payment workflow writes a predictable file in /tmp before signing it. Another local process can race or replace that path, changing the signed payload or causing an unintended file overwrite.

Risk Factors

🌐 Network access (17)

references/discover-agents.md:21 references/discover-agents.md:24 references/discover-agents.md:27 references/heurist-api-key.md:13 references/inflow-payment.md:20 references/inflow-payment.md:32 references/inflow-payment.md:54 references/inflow-payment.md:82 references/x402-payment.md:8 references/x402-payment.md:15 references/x402-payment.md:103 references/x402-payment.md:113 SKILL.md:7 SKILL.md:89 SKILL.md:98 SKILL.md:136 SKILL.md:137

🔑 Env variables (15)

references/heurist-api-key.md:15 references/heurist-api-key.md:23 references/inflow-payment.md:10 references/inflow-payment.md:35 references/inflow-payment.md:81 references/x402-payment.md:45 references/x402-payment.md:85 SKILL.md:72 SKILL.md:73 SKILL.md:74 SKILL.md:78 SKILL.md:79 SKILL.md:80 SKILL.md:99 SKILL.md:127

⚙️ External commands (49)

📁 Filesystem access (2)

references/x402-payment.md:49 references/x402-payment.md:85

Detected Patterns

Pipe to shell pattern×2

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/internet-court-heurist-mesh-skill/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-heurist-mesh-skill/security.svg)](https://skillstore.io/skills/internet-court-heurist-mesh-skill?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-heurist-mesh-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-heurist-mesh-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-heurist-mesh-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

internet-court. (2026). heurist-mesh-skill security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-heurist-mesh-skill/audits/2

BibTeX citation

@techreport{internet-court-internet-court-heurist-mesh-skill-2026,
  author = {internet-court},
  title = {heurist-mesh-skill security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/internet-court-heurist-mesh-skill/audits/2},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "heurist-mesh-skill security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
  - name: "internet-court"
date-released: "2026-07-21"
url: "https://skillstore.io/skills/internet-court-heurist-mesh-skill/audits/2"
identifiers:
  - type: other
    value: "skillstore:internet-court-heurist-mesh-skill:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Monitor Token Momentum

Track trending tokens, market summaries, and notable social signals before preparing a market brief.

Compare Protocol Metrics

Review TVL, fees, revenue, chain coverage, and growth trends across DeFi protocols.

Investigate Wallet Activity

Summarize wallet holdings, NFT collections, address labels, and related project context.

Try These Prompts

Check Trending Tokens

Use Heurist Mesh to show tokens trending now. Include the agent used, key metrics, and a short risk note.

Research a Token Profile

Resolve [TOKEN] with TokenResolverAgent, fetch its profile, and summarize market pairs, indicators, and funding data.

Compare DeFi Protocols

Fetch current metrics for [PROTOCOL A] and [PROTOCOL B]. Compare TVL, fees, chains, revenue, and recent growth.

Build a Multi-Agent Market Brief

Discover the best Heurist Mesh agents for [MARKET QUESTION]. Fetch schemas, run only necessary paid calls, and produce a sourced brief.

Best Practices

Fetch the current agent schema before each new workflow.
Confirm pricing, credentials, and payment method before any paid API call.
Ask the user to disambiguate tokens, wallets, or projects before expensive follow-up calls.