Versioned security assessment

Report ID: SA-3F6E026A

7/21/2026, 3:18:40 AM

heurist-mesh-skill security assessment v2

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: claude Latest published report
Skill name
heurist-mesh-skill
Version
v2
Maintainer
internet-court
Source
github.com/internet-court/internet-court-skill/tree/main/vendored/heurist/heurist-mesh-skill
Coverage
6 Files scanned · 499 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

Critical

14 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill documents legitimate cryptocurrency research and paid API access, but it handles API keys and wallet private keys. It also includes a remote installer piped to bash, an unsafe installation pattern, and a payment flow that can authorize USDC transfers. Most shell-backtick and reconnaissance detections are Markdown or descriptive false positives.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Attestation unavailable

No public attestation is available for this report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

6 Files scanned · 499 Lines analyzed

31 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 17 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Observed in 15 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 49 evidence locations

Capability review items (17)
High
references/heurist-api-key.md:15
Generic API/secret keys
4. Returns `api_key`, `credits` (100), and `twitter_handle`. One claim per Twitter handle. Code expi
The documentation provisions and uses an API key for authenticated Mesh requests. The key is sensitive and should be scoped and handled only with user approval.
High
references/heurist-api-key.md:23
Generic API/secret keys
Authorization: Bearer <api_key>
The documentation provisions and uses an API key for authenticated Mesh requests. The key is sensitive and should be scoped and handled only with user approval.
High
references/inflow-payment.md:10
Generic API/secret keys
INFLOW_PRIVATE_KEY=your-buyer-private-key
The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.
High
references/inflow-payment.md:35
Generic API/secret keys
"privateKey":"<INFLOW_PRIVATE_KEY>",
The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.
High
references/inflow-payment.md:81
Generic API/secret keys
curl -sS -H "X-API-Key: $INFLOW_PRIVATE_KEY" \
The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.
High
references/x402-payment.md:45
Generic API/secret keys
WALLET=$(cast wallet address --private-key "$PRIVATE_KEY")
The workflow requires a wallet private key to derive an address and sign a USDC payment authorization. This is sensitive financial capability and requires explicit user control.
High
references/x402-payment.md:85
Generic API/secret keys
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
The workflow requires a wallet private key to derive an address and sign a USDC payment authorization. This is sensitive financial capability and requires explicit user control.
High
SKILL.md:72
Generic API/secret keys
- **API key (recommended):** Set `HEURIST_API_KEY` in `.env`. Setup and free-credit flow: [reference
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
SKILL.md:73
Generic API/secret keys
- **x402 on Base:** Set `WALLET_PRIVATE_KEY` in `.env`. Signed payment flow: [references/x402-paymen
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
SKILL.md:74
Generic API/secret keys
- **Inflow:** Set `INFLOW_USER_ID` and `INFLOW_PRIVATE_KEY` in `.env`. Buyer setup and approval flow
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
SKILL.md:78
Generic API/secret keys
- API key path: `HEURIST_API_KEY` is set and non-empty
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
SKILL.md:79
Generic API/secret keys
- x402 path: `WALLET_PRIVATE_KEY` is set, starts with `0x`, and is 66 characters
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
SKILL.md:80
Generic API/secret keys
- Inflow path: `INFLOW_USER_ID` and `INFLOW_PRIVATE_KEY` are set and non-empty
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
SKILL.md:99
Generic API/secret keys
-H "Authorization: Bearer $HEURIST_API_KEY" \
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
High
SKILL.md:127
Generic API/secret keys
- `402`: Payment required; follow the selected payment path (`HEURIST_API_KEY`, x402 flow, or Inflow
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
Medium
references/x402-payment.md:49
Temp directory access
cat > /tmp/eip712.json << EOF
The payment workflow writes a predictable file in /tmp before signing it. Another local process can race or replace that path, changing the signed payload or causing an unintended file overwrite.
Medium
references/x402-payment.md:85
Temp directory access
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
The payment workflow writes a predictable file in /tmp before signing it. Another local process can race or replace that path, changing the signed payload or causing an unintended file overwrite.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (14)

RISK-001 Critical
references/x402-payment.md:8
Pipe to shell pattern
curl -L https://foundry.paradigm.xyz | bash
The documentation instructs users to pipe a remotely fetched installer directly into bash. A compromised or substituted download would execute arbitrary code without inspection.
RISK-002 Critical
references/x402-payment.md:123
Pipe to shell pattern
- `cast` from Foundry (`curl -L https://foundry.paradigm.xyz | bash && foundryup`)
The documentation instructs users to pipe a remotely fetched installer directly into bash. A compromised or substituted download would execute arbitrary code without inspection.
RISK-003 High
references/inflow-payment.md:7
Environment file access
Store in `.env`:
No evidence was found to safely dismiss the detected pattern; it is retained for review.
RISK-004 High
references/inflow-payment.md:25
Environment file access
Save from response: `data.userId` and `data.privateKey` into `.env`.
The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.
RISK-005 High
references/inflow-payment.md:25
Crypto seed/private key mention
Save from response: `data.userId` and `data.privateKey` into `.env`.
The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.
RISK-006 High
references/inflow-payment.md:35
Crypto seed/private key mention
"privateKey":"<INFLOW_PRIVATE_KEY>",
The workflow handles an Inflow private key and sends it as an authentication value to payment-related services. Compromise or unintended use of this credential can authorize activity.
RISK-007 High
references/x402-payment.md:3
Crypto seed/private key mention
Pay per tool call with USDC on Base. No account needed — just a private key with USDC balance and `c
The workflow requires a wallet private key to derive an address and sign a USDC payment authorization. This is sensitive financial capability and requires explicit user control.
RISK-008 High
references/x402-payment.md:121
Crypto seed/private key mention
- Private key with USDC balance on Base
The workflow requires a wallet private key to derive an address and sign a USDC payment authorization. This is sensitive financial capability and requires explicit user control.
RISK-009 High
SKILL.md:72
Environment file access
- **API key (recommended):** Set `HEURIST_API_KEY` in `.env`. Setup and free-credit flow: [reference
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
RISK-010 High
SKILL.md:73
Environment file access
- **x402 on Base:** Set `WALLET_PRIVATE_KEY` in `.env`. Signed payment flow: [references/x402-paymen
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
RISK-011 High
SKILL.md:74
Environment file access
- **Inflow:** Set `INFLOW_USER_ID` and `INFLOW_PRIVATE_KEY` in `.env`. Buyer setup and approval flow
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
RISK-012 High
SKILL.md:76
Environment file access
### Step 2: Verify setup in `.env`
No evidence was found to safely dismiss the detected pattern; it is retained for review.
RISK-013 High
SKILL.md:126
Environment file access
- `401`/`403`: Treat as credential issue; ask user to re-check `.env` values and do not continue cal
The skill directs use of API or wallet credentials from .env, including an authenticated request to the Mesh service. Credential access and paid requests require explicit user authorization.
RISK-014 High
references/x402-payment.md:24-40references/x402-payment.md:42-97
Unbounded Cryptocurrency Payment Authorization
The x402 flow obtains payment metadata, signs a USDC transfer authorization with a wallet private key, and submits it without requiring a separate confirmation of recipient and amount.
The documented sequence explicitly receives payment terms, creates an EIP-712 transfer authorization, signs it with a private key, and sends the payment header. This enables real financial transactions.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote installer is piped directly into bash.
    Replace the pipe-to-shell installation command with a version-pinned download, published checksum, and separate user-reviewed execution step.
  2. FIX-002
    High
    The x402 flow can sign and submit a USDC payment authorization without an explicit confirmation gate.
    Require explicit confirmation showing the recipient, network, amount, token, and maximum spend before signing. Enforce a configurable spend cap and recipient allowlist.
  3. FIX-003
    High
    Credentials and wallet keys are expected in .env.
    Use a dedicated low-balance wallet, scoped API keys, secret storage, and never log or transmit credentials beyond the intended authenticated request.
  4. FIX-004
    Medium
    The payment workflow writes a predictable file in /tmp.
    Use a securely created temporary file with restrictive permissions, then delete it after signing.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
3f6e026a3363e0954ede7bef0cfe88d4475de137
Content hash
508a77bbf938aebfe0d05a403c70b474b490301d2b785d4ceb62ac11e0d2b093
Tree hash
c4455848a19f8471ff6dcc233432627319af01f4a28513ce199bf28b97422fe6
Skill path
skills/internet-court/heurist-mesh-skill
Audit payload hash
6c71253c27f79e2829970e7a117ed105

Analysis metadata

Audit model: claude

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: unavailable