Didit Face Match
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill appears to do what it says, but users should know it sends selected face images to Didit and the API may save requests by default.
This skill is appropriate if you intentionally want to compare two face images with Didit. Before using it, make sure you have permission to process the faces, confirm the exact files being uploaded, protect the DIDIT_API_KEY, and review or disable Didit's default request-saving behavior if you do not want biometric data retained in the Business Console.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The face images chosen for comparison are transmitted to Didit for processing.
The helper reads two local file paths and uploads them to the stated Didit Face Match endpoint. This is expected for the skill, but the selected files leave the local machine.
with open(user_image, "rb") as uf, open(ref_image, "rb") as rf: ... response = requests.post(API_URL, headers=headers, files=files, data=data, timeout=60)
Use only with images you intend to send to Didit, confirm consent for biometric processing, and verify the file paths before running.
Anyone with access to the configured API key could use the associated Didit account and potentially consume credits.
The script uses a Didit API key from the environment as the account credential for requests. This is disclosed and expected for the integration.
api_key = os.environ.get("DIDIT_API_KEY") ... headers = {"x-api-key": api_key}Store the API key securely, use the least-privileged or dedicated key available, and rotate it if it is exposed.
Face-match requests may be retained by Didit instead of being only transient API calls.
The documentation states that Didit's API saves requests by default. For a biometric workflow, this means images or related results may persist in the provider's console beyond the immediate comparison.
`save_api_request` | boolean | No | `true` | — | Save in Business Console Manual Checks
Review Didit's retention/privacy settings and set save_api_request to false where appropriate before processing sensitive biometric images.