heurist-mesh-skill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow can fetch and incorporate web-derivative content via the skill’s “Twitter/X signal checks” and “Web search with summarization / scrape a URL” tools (ExaSearchDigestAgent), which at runtime may ingest outsider-authored free text from public pages or posts into the LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs fetching live agent schemas and registries at runtime (e.g., GET https://mesh.heurist.xyz/mesh_schema?agent_id=TokenResolverAgent&agent_id=TrendingTokenAgent and https://mesh.heurist.ai/metadata.json), and those responses are required and used to determine tool parameters and agent behavior, so these runtime-fetched URLs directly control the agent's subsequent prompts/requests.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly requires and documents crypto payment paths that use private keys and a signed payment flow (x402 on Base with WALLET_PRIVATE_KEY, Inflow with INFLOW_PRIVATE_KEY) and references signing transactions (cast-based flow). These are specific crypto wallet/payment integrations (private-key-based signing) — i.e., explicit financial execution capability.