Didit Database Validation

• Outcome: Pass
• Latest audit: May 28, 2026, 1:24 PM
• Version:
  1.1.0

Overview

This skill is a disclosed Didit identity-database validation integration, but users should treat it as sensitive because it sends government ID data to a third-party API and may involve paid requests.

Install only if you intend to use Didit for identity checks. Confirm consent and legal authority before submitting anyone's ID data, review Didit's privacy and retention terms, keep DIDIT_API_KEY in secure environment storage, redact logs, and require explicit approval for account registration, credit top-ups, or paid validation calls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This section encourages use of government-database identity verification without a prominent privacy warning, despite handling highly sensitive personal data such as national ID numbers, names, and dates of birth. Users may transmit regulated PII to a third party without understanding retention, consent, cross-border transfer, or legal-compliance implications.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The examples show direct transmission of identity data and inclusion of an API key header, but they do not warn against hardcoding credentials, logging request payloads, or exposing PII in source code and telemetry. In practice, developers often copy examples verbatim, which can lead to credential leakage and unnecessary disclosure of sensitive identity records.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script transmits highly sensitive identity data, including government ID numbers and optionally name and date of birth, to an external service without any explicit runtime warning, consent prompt, or privacy notice. In an agent-skill context, this increases the risk that users or operators may submit regulated personal data without understanding that it leaves the local environment and is processed by a third party.

VirusTotal

66/66 vendors flagged this skill as clean.