Versioned security assessment
Report ID: SA-A005F84B
7/9/2026, 11:50:48 PM
heurist-mesh-skill security assessment v1
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- heurist-mesh-skill
- Version
- v1
- Maintainer
- internet-court
- Coverage
- 6 Files scanned · 499 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
14 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The skill is an expected networked crypto research connector, and many Markdown backtick findings are false positives. Real risks remain: private key and API key handling, paid payment flows, external command examples, temporary signing files, and pipe-to-shell Foundry install commands. No prompt injection text was found in the reviewed files.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
6 Files scanned · 499 Lines analyzed
50 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 17 evidence locations
Filesystem access
May read or write local files.
Observed in 2 evidence locations
Env variables
May read values from the process environment.
Observed in 15 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 49 evidence locations
Capability review items (36)
High
Generic API/secret keys
4. Returns `api_key`, `credits` (100), and `twitter_handle`. One claim per Twitter handle. Code expi
The line handles an API credential used to authorize Heurist Mesh calls. Credentials in prompts, headers, or environment files must be protected from disclosure and logging.
High
Generic API/secret keys
Authorization: Bearer <api_key>
The line handles an API credential used to authorize Heurist Mesh calls. Credentials in prompts, headers, or environment files must be protected from disclosure and logging.
High
Generic API/secret keys
INFLOW_PRIVATE_KEY=your-buyer-private-key
The line handles a wallet or Inflow private key used for payment authorization. Exposure or misuse of this value can spend funds or compromise the payment account.
High
Generic API/secret keys
"privateKey":"<INFLOW_PRIVATE_KEY>",
The line handles a wallet or Inflow private key used for payment authorization. Exposure or misuse of this value can spend funds or compromise the payment account.
High
Generic API/secret keys
curl -sS -H "X-API-Key: $INFLOW_PRIVATE_KEY" \
The line handles a wallet or Inflow private key used for payment authorization. Exposure or misuse of this value can spend funds or compromise the payment account.
High
Generic API/secret keys
WALLET=$(cast wallet address --private-key "$PRIVATE_KEY")
The line handles a wallet or Inflow private key used for payment authorization. Exposure or misuse of this value can spend funds or compromise the payment account.
High
Generic API/secret keys
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
The line handles a wallet or Inflow private key used for payment authorization. Exposure or misuse of this value can spend funds or compromise the payment account.
High
Generic API/secret keys
- **API key (recommended):** Set `HEURIST_API_KEY` in `.env`. Setup and free-credit flow: [reference
The line handles an API credential used to authorize Heurist Mesh calls. Credentials in prompts, headers, or environment files must be protected from disclosure and logging.
High
Generic API/secret keys
- **x402 on Base:** Set `WALLET_PRIVATE_KEY` in `.env`. Signed payment flow: [references/x402-paymen
The line handles a wallet or Inflow private key used for payment authorization. Exposure or misuse of this value can spend funds or compromise the payment account.
High
Generic API/secret keys
- **Inflow:** Set `INFLOW_USER_ID` and `INFLOW_PRIVATE_KEY` in `.env`. Buyer setup and approval flow
The line handles a wallet or Inflow private key used for payment authorization. Exposure or misuse of this value can spend funds or compromise the payment account.
High
Generic API/secret keys
- API key path: `HEURIST_API_KEY` is set and non-empty
The line handles an API credential used to authorize Heurist Mesh calls. Credentials in prompts, headers, or environment files must be protected from disclosure and logging.
High
Generic API/secret keys
- x402 path: `WALLET_PRIVATE_KEY` is set, starts with `0x`, and is 66 characters
The line handles a wallet or Inflow private key used for payment authorization. Exposure or misuse of this value can spend funds or compromise the payment account.
High
Generic API/secret keys
- Inflow path: `INFLOW_USER_ID` and `INFLOW_PRIVATE_KEY` are set and non-empty
The line handles a wallet or Inflow private key used for payment authorization. Exposure or misuse of this value can spend funds or compromise the payment account.
High
Generic API/secret keys
-H "Authorization: Bearer $HEURIST_API_KEY" \
The line handles an API credential used to authorize Heurist Mesh calls. Credentials in prompts, headers, or environment files must be protected from disclosure and logging.
Medium
Shell command substitution
WALLET=$(cast wallet address --private-key "$PRIVATE_KEY")
This is an executable shell snippet in the x402 payment signing flow. The commands are mostly fixed, but running local tools with payment keys creates real command and transaction-signing risk.
Medium
Shell command substitution
NONCE=0x$(openssl rand -hex 32)
This is an executable shell snippet in the x402 payment signing flow. The commands are mostly fixed, but running local tools with payment keys creates real command and transaction-signing risk.
Medium
Shell command substitution
VALID_BEFORE=$(( $(date +%s) + 120 ))
This is an executable shell snippet in the x402 payment signing flow. The commands are mostly fixed, but running local tools with payment keys creates real command and transaction-signing risk.
Medium
Shell command substitution
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
This is an executable shell snippet in the x402 payment signing flow. The commands are mostly fixed, but running local tools with payment keys creates real command and transaction-signing risk.
Medium
Shell command substitution
X_PAYMENT=$(printf '{"x402Version":1,"scheme":"exact","network":"base","payload":{"signature":"%s","
This is an executable shell snippet in the x402 payment signing flow. The commands are mostly fixed, but running local tools with payment keys creates real command and transaction-signing risk.
Medium
Temp directory access
cat > /tmp/eip712.json << EOF
The payment signing flow writes and later reads an EIP-712 payload under /tmp. A predictable shared temp path can expose transaction details or be clobbered without secure permissions and cleanup.
Medium
Temp directory access
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
The payment signing flow writes and later reads an EIP-712 payload under /tmp. A predictable shared temp path can expose transaction details or be clobbered without secure permissions and cleanup.
Low
Hardcoded URL
curl -sS https://mesh.heurist.ai/metadata.json
The line directs calls to external Heurist or Inflow service endpoints. This is intended functionality, but it exposes user queries, wallet data, or payment metadata to third-party services.
Low
Hardcoded URL
curl -sS https://mesh.heurist.xyz/x402/agents
The line directs calls to external Heurist or Inflow service endpoints. This is intended functionality, but it exposes user queries, wallet data, or payment metadata to third-party services.
Low
Hardcoded URL
curl -sS "https://mesh.heurist.xyz/mesh_schema?agent_id=TokenResolverAgent&agent_id=DefiLlamaAgent&a
The line directs calls to external Heurist or Inflow service endpoints. This is intended functionality, but it exposes user queries, wallet data, or payment metadata to third-party services.
Low
Hardcoded URL
curl -sS -X POST "https://mesh.heurist.xyz/mesh_signup_inflow" \
The line directs calls to external Heurist or Inflow service endpoints. This is intended functionality, but it exposes user queries, wallet data, or payment metadata to third-party services.
Low
Hardcoded URL
curl -sS -X POST "https://mesh.heurist.xyz/mesh_signup_inflow_attach" \
The line directs calls to external Heurist or Inflow service endpoints. This is intended functionality, but it exposes user queries, wallet data, or payment metadata to third-party services.
Low
Hardcoded URL
curl -sS -X POST "https://mesh.heurist.xyz/mesh_request" \
The line directs calls to external Heurist or Inflow service endpoints. This is intended functionality, but it exposes user queries, wallet data, or payment metadata to third-party services.
Low
Hardcoded URL
"https://app.inflowpay.ai/v1/requests/<REQUEST_ID>"
The line directs calls to external Heurist or Inflow service endpoints. This is intended functionality, but it exposes user queries, wallet data, or payment metadata to third-party services.
Low
Hardcoded URL
curl -L https://foundry.paradigm.xyz | bash
The URL is used in a curl command that is piped to a shell. The network endpoint is part of a dangerous installer path, with critical risk captured by the pipe-to-shell finding.
Low
Hardcoded URL
POST https://mesh.heurist.xyz/x402/agents/{AgentId}/{toolName}
The line directs calls to external Heurist or Inflow service endpoints. This is intended functionality, but it exposes user queries, wallet data, or payment metadata to third-party services.
Low
Hardcoded URL
curl https://mesh.heurist.xyz/x402/agents
The line directs calls to external Heurist or Inflow service endpoints. This is intended functionality, but it exposes user queries, wallet data, or payment metadata to third-party services.
Low
Hardcoded URL
url: 'https://mesh.heurist.xyz/x402/agents/TrendingTokenAgent/get_trending_tokens',
The line directs calls to external Heurist or Inflow service endpoints. This is intended functionality, but it exposes user queries, wallet data, or payment metadata to third-party services.
Low
Hardcoded URL
GET https://mesh.heurist.xyz/mesh_schema?agent_id=TokenResolverAgent&agent_id=TrendingTokenAgent
The line directs calls to external Heurist or Inflow service endpoints. This is intended functionality, but it exposes user queries, wallet data, or payment metadata to third-party services.
Low
Hardcoded URL
curl -X POST https://mesh.heurist.xyz/mesh_request \
The line directs calls to external Heurist or Inflow service endpoints. This is intended functionality, but it exposes user queries, wallet data, or payment metadata to third-party services.
Low
Hardcoded URL
- All agents: `https://mesh.heurist.ai/metadata.json`
The line directs calls to external Heurist or Inflow service endpoints. This is intended functionality, but it exposes user queries, wallet data, or payment metadata to third-party services.
Low
Hardcoded URL
- x402-enabled agents: `https://mesh.heurist.xyz/x402/agents`
The line directs calls to external Heurist or Inflow service endpoints. This is intended functionality, but it exposes user queries, wallet data, or payment metadata to third-party services.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (14)
RISK-001 Critical
Pipe to shell pattern
curl -L https://foundry.paradigm.xyz | bash
The documentation instructs users to download a remote installer and pipe it directly to a shell. This can execute arbitrary remote code if the endpoint, transport, or local environment is compromised.
RISK-002 Critical
Pipe to shell pattern
- `cast` from Foundry (`curl -L https://foundry.paradigm.xyz | bash && foundryup`)
The documentation instructs users to download a remote installer and pipe it directly to a shell. This can execute arbitrary remote code if the endpoint, transport, or local environment is compromised.
RISK-003 High
Environment file access
Store in `.env`:
The line directs credential storage or checks in a .env file. This is common but sensitive because agents, logs, or shared workspaces can expose secret values.
RISK-004 High
Environment file access
Save from response: `data.userId` and `data.privateKey` into `.env`.
The line instructs users to handle a crypto or payment private key. Private key exposure can directly authorize payments or compromise funds.
RISK-005 High
Crypto seed/private key mention
Save from response: `data.userId` and `data.privateKey` into `.env`.
The line instructs users to handle a crypto or payment private key. Private key exposure can directly authorize payments or compromise funds.
RISK-006 High
Crypto seed/private key mention
"privateKey":"<INFLOW_PRIVATE_KEY>",
The line instructs users to handle a crypto or payment private key. Private key exposure can directly authorize payments or compromise funds.
RISK-007 High
Crypto seed/private key mention
Pay per tool call with USDC on Base. No account needed — just a private key with USDC balance and `c
The line instructs users to handle a crypto or payment private key. Private key exposure can directly authorize payments or compromise funds.
RISK-008 High
Crypto seed/private key mention
- Private key with USDC balance on Base
The line instructs users to handle a crypto or payment private key. Private key exposure can directly authorize payments or compromise funds.
RISK-009 High
Environment file access
- **API key (recommended):** Set `HEURIST_API_KEY` in `.env`. Setup and free-credit flow: [reference
The line directs credential storage or checks in a .env file. This is common but sensitive because agents, logs, or shared workspaces can expose secret values.
RISK-010 High
Environment file access
- **x402 on Base:** Set `WALLET_PRIVATE_KEY` in `.env`. Signed payment flow: [references/x402-paymen
The line instructs users to handle a crypto or payment private key. Private key exposure can directly authorize payments or compromise funds.
RISK-011 High
Environment file access
- **Inflow:** Set `INFLOW_USER_ID` and `INFLOW_PRIVATE_KEY` in `.env`. Buyer setup and approval flow
The line instructs users to handle a crypto or payment private key. Private key exposure can directly authorize payments or compromise funds.
RISK-012 High
Environment file access
### Step 2: Verify setup in `.env`
The line directs credential storage or checks in a .env file. This is common but sensitive because agents, logs, or shared workspaces can expose secret values.
RISK-013 High
Environment file access
- `401`/`403`: Treat as credential issue; ask user to re-check `.env` values and do not continue cal
The line directs credential storage or checks in a .env file. This is common but sensitive because agents, logs, or shared workspaces can expose secret values.
RISK-014 High
Agent-Mediated Paid Transaction Flow
The skill instructs agents to configure API keys, wallet private keys, or Inflow credentials before calling paid Mesh APIs. The x402 path signs and submits USDC payment headers, so missing spend caps or per-call consent can cause unintended charges.
The cited files explicitly require payment setup and describe signed or approved paid request flows. Inflow includes approval, but x402 relies on signing with a private key and needs stronger spend controls.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalPipe-to-shell Foundry installation commandsReplace curl-to-shell installation with a package manager, pinned release, checksum verification, or a manual install link.
- FIX-002HighWallet and Inflow private keys stored in .envUse a hardware wallet, dedicated low-balance signer, or secret vault, and avoid exposing raw keys to agents.
- FIX-003HighAgent-mediated paid API callsRequire explicit user approval, visible price information, a maximum spend limit, and retry caps before paid requests.
- FIX-004MediumTemporary EIP-712 signing file in /tmpUse a secure temporary file with restricted permissions and cleanup, or sign from memory when possible.
- FIX-005LowExternal endpoint and data sharing exposureDocument all third-party endpoints and describe which queries, wallet addresses, and payment metadata are sent.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable