Heurist Mesh Crypto Analysis Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:33 AM UTC
• Version: 1.0.3

Overview

This skill is a coherent Heurist Mesh crypto API guide, but it asks agents to handle payment private keys and on-chain signing with insufficient safeguards and includes an unsafe remote installer command.

Review before installing. Prefer the API-key payment path over raw wallet signing, use a dedicated low-balance wallet if using x402, do not store production private keys in project .env files, and do not run the documented curl-to-bash Foundry installer without independent verification. Require explicit approval of recipient, amount, network, and endpoint before any payment signature is created.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/x402-payment.md:8

Finding

Unverified Remote Foundry Installer Is Piped Directly into Bash

Content

View full analysis

Remediation

View remediation

//foundry-release.tar.gz" ``` 4. Publish the expected SHA-256 digest in the Skill and verify it before extraction: ```bash echo " foundry-release.tar.gz" | sha256sum --check - ``` 5. Where available, verify a release signature using a pinned and independently obtained maintainer public key. 6. Ask the user to review and explicitly approve installation before executing any downloaded component. 7. Install with ordinary user privileges into a restricted directory. Do not request `sudo` unless a separately justified operation requires it. 8. Document package-manager installation as an alternative where the package source, version, and signature validation are managed by a trusted system repository. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/x402-payment.md:17

Finding

Unvalidated Server-Supplied x402 Payment Terms Are Signed with the Wallet Private Key

Content

View full analysis

/tmp/eip712.json << EOF { "types": { "EIP712Domain": [ {"name": "name", "type": "string"}, {"name": "version", "type": "string"}, {"name": "chainId", "type": "uint256"}, {"name": "verifyingContract", "type": "address"} ], "TransferWithAuthorization": [ {"name": "from", "type": "address"}, {"name": "to", "type": "address"}, {"name": "value", "type": "uint256"}, {"name": "validAfter", "type": "uint256"}, {"name": "validBefore", "type": "uint256"}, {"name": "nonce", "type": "bytes32"} ] }, "primaryType": "TransferWithAuthorization", "domain": { "name": "USD Coin", "version": "2", "chainId": 8453, "verifyingContract": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" }, "message": { "from": "$WALLET", "to": "$PAY_TO", "value": $AMOUNT, "validAfter": 0, "validBefore": $VALID_BEFORE, "nonce": "$NONCE" } } EOF SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json) ``` ### Technical Analysis The documented ...[truncated 2294 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/x402-payment.md:36

Finding

Predictable Shared Temporary File Is Used for Wallet Signing Data

Content

View full analysis

/tmp/eip712.json << EOF { "types": { "EIP712Domain": [ {"name": "name", "type": "string"}, {"name": "version", "type": "string"}, {"name": "chainId", "type": "uint256"}, {"name": "verifyingContract", "type": "address"} ], "TransferWithAuthorization": [ {"name": "from", "type": "address"}, {"name": "to", "type": "address"}, {"name": "value", "type": "uint256"}, {"name": "validAfter", "type": "uint256"}, {"name": "validBefore", "type": "uint256"}, {"name": "nonce", "type": "bytes32"} ] }, "primaryType": "TransferWithAuthorization", "domain": { "name": "USD Coin", "version": "2", "chainId": 8453, "verifyingContract": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" }, "message": { "from": "$WALLET", "to": "$PAY_TO", "value": $AMOUNT, "validAfter": 0, "validBefore": $VALID_BEFORE, "nonce": "$NONCE" } } EOF SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json) ``` ### Technical Analysis The workflow uses the fixed path `/tmp/eip712.json` in a directory commonly shared by multiple local users and processes. It does not create the file with exclusive semantics, check whether the path is a symbolic link, restrict its permissions, verify ownership, or remove it after signing. Two security problems result: 1. **Symbolic-link overwrite:** An attacker who can create `/tmp/eip712.json` first may point it at another file writable by the victim. The shell redirection follows the link and overwrit ...[truncated 1759 chars]

Remediation

View remediation

"$EIP712_FILE" <

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Piping a remote script directly into bash executes code fetched over the network without prior inspection or pinning. If the hosting endpoint, DNS, TLS trust chain, or upstream distribution is compromised, users may execute arbitrary attacker-controlled code on their machine.

Content

Scanner excerpt · references/x402-payment.md (reported line 8)May include surrounding context.

Install Foundry:

bash

curl -L https://foundry.paradigm.xyz | bash
foundryup

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The use of '| bash' is a classic command-chaining anti-pattern because it combines retrieval and execution into one opaque step, removing the opportunity for inspection and making supply-chain compromise immediately exploitable. In a skill intended for broad user adoption, this materially raises the chance of arbitrary code execution on user systems.

Content

Scanner excerpt · references/x402-payment.md (reported line 8)May include surrounding context.

Install Foundry:

bash

curl -L https://foundry.paradigm.xyz | bash
foundryup

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/x402-payment.md (reported line 94)May include surrounding context.

md

X_PAYMENT=$(printf '{"x402Version":1,"scheme":"exact","network":"base","payload":{"signature":"%s","authorization":{"from":"%s","to":"%s","value":"%s","validAfter":"0","validBefore":"%s","nonce":"%s"}}}' \
  "$SIG" "$WALLET" "$PAY_TO" "$AMOUNT" "$VALID_BEFORE" "$NONCE" | base64 -w 0)

curl -s -X POST "$URL" \
  -H "Content-Type: application/json" \
  -H "X-Payment: $X_PAYMENT" \
  -d "$BODY"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to place highly sensitive wallet private keys in a local .env file without any explicit warning, handling guidance, or safer alternatives. In a crypto context, compromise of WALLET_PRIVATE_KEY or payment keys can directly lead to theft of funds, unauthorized transactions, or abuse of paid API/payment accounts.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

bash

# With API key
curl -X POST https://mesh.heurist.xyz/mesh_request \
  -H "Authorization: Bearer $HEURIST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"agent_id": "TokenResolverAgent", "input": {"tool": "token_search", "tool_arguments": {"query": "ETH"}, "raw_data_only": true}}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document instructs users to store a payment-platform private key in a local .env file but gives no warning that this credential can authorize buyer actions and should be treated like a secret. In agentic or developer environments, .env files are commonly copied, committed, logged, or exposed through debugging, so normalizing this storage pattern without safeguards increases the chance of credential compromise.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/inflow-payment.md (reported line 20)May include surrounding context.

Create agentic user

bash

curl -sS -X POST "https://mesh.heurist.xyz/mesh_signup_inflow" \
  -H "Content-Type: application/json" \
  -d '{"locale":"EN_US","timezone":"US/Pacific"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Telling users to save data.privateKey from an API response directly into .env operationalizes insecure secret handling without describing the risk of theft or misuse. Because this key appears to authenticate with the payment provider, exposure could let an attacker impersonate the buyer, inspect requests, or initiate payment-related actions within the platform's trust model.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The example transmits a signed payment authorization to a remote endpoint using the X-Payment header. Although this is the intended protocol behavior, it sends a transferable authorization artifact off-host, so mistakes in endpoint validation, logging, interception, or replay handling could result in unintended charges or data leakage.

Content

Scanner excerpt · references/x402-payment.md (reported line 94)May include surrounding context.

md

X_PAYMENT=$(printf '{"x402Version":1,"scheme":"exact","network":"base","payload":{"signature":"%s","authorization":{"from":"%s","to":"%s","value":"%s","validAfter":"0","validBefore":"%s","nonce":"%s"}}}' \
  "$SIG" "$WALLET" "$PAY_TO" "$AMOUNT" "$VALID_BEFORE" "$NONCE" | base64 -w 0)

curl -s -X POST "$URL" \
  -H "Content-Type: application/json" \
  -H "X-Payment: $X_PAYMENT" \
  -d "$BODY"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions require use of a raw private key and authorize an on-chain USDC transfer, but they do not provide an explicit warning that this can spend real funds or that exposing the key compromises the wallet. In a crypto payment workflow this is contextually expected, but the absence of safety guidance increases the risk that users paste production keys into shells, logs, or untrusted environments.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description limits the skill to crypto token data, DeFi analytics, blockchain data, Twitter/X intelligence, web search, crypto project search, and Ask Heurist for deeper topics. The documentation later promotes additional capabilities such as transaction history lookup, transaction tracing, Firecrawl scraping, GoPlus security screening, Twitter influence checking, and SQL blockchain querying, which materially broaden the stated scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.