Didit Phone Verification

• Risk level: Low
• Analyzed: May 1, 2026, 5:42 AM
• Findings: 3
• Version: 1.3.0

Overview

The skill coherently uses a Didit API key to send and check phone verification codes, with disclosed external messaging and phone-data sharing that users should control carefully.

Before installing, make sure you trust Didit for phone verification data, configure DIDIT_API_KEY securely, and require clear user confirmation before sending codes or using any optional account setup or credit top-up instructions.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Note

What this means

Using the skill can send real verification messages or calls to phone numbers.

Why it was flagged

The helper can trigger an external Didit send-code API call, which may contact a phone number and consume account credits; this is disclosed and central to the skill purpose.

Skill content

response = requests.post(f"{BASE_URL}/send/", headers=get_headers(), json=payload, timeout=30)

Recommendation

Only send codes to numbers the user is authorized to verify, and confirm the number and delivery channel before sending.

ASI03: Identity and Privilege Abuse

Note

What this means

Anyone with the configured API key could use the associated Didit account's phone verification capabilities and credits.

Why it was flagged

The skill uses the user's Didit API key to authenticate requests; that credential is expected for the service and is not hardcoded or logged in the shown code.

Skill content

api_key = os.environ.get("DIDIT_API_KEY") ... return {"x-api-key": api_key, "Content-Type": "application/json"}

Recommendation

Store the API key securely as an environment variable, use the least-privileged key available, and rotate it if it is exposed.

ASI07: Insecure Inter-Agent Communication

Note

What this means

Phone numbers, OTP codes, and optional session identifiers may leave the local environment and be processed by Didit.

Why it was flagged

Phone numbers and verification codes are sent to the external Didit provider for checking; this data flow is expected for OTP verification but involves sensitive user data.

Skill content

payload = {"phone_number": phone, "code": code, ...} ... BASE_URL = "https://verification.didit.me/v3/phone"

Recommendation

Use the skill only with user consent, avoid sending unnecessary identifiers in vendor_data, and review Didit's data handling policies if this is used for production verification.