T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/screen_aml.py:34- Finding
Sensitive AML identity data may be retained by the remote provider without explicit opt-in
- Content
View full analysis
dict: api_key = get_api_key() payload = {"full_name": full_name, "entity_type": entity_type} if date_of_birth: payload["date_of_birth"] = date_of_birth if nationality: payload["nationality"] = nationality if document_number: payload["document_number"] = document_number if threshold is not None: payload["aml_match_score_threshold"] = threshold if vendor_data: payload["vendor_data"] = vendor_data r = requests.post(ENDPOINT, headers={"x-api-key": api_key, "Content-Type": "application/json"}, json=payload, timeout=60) ``` The documented API behavior is: ```text save_api_request | boolean | No | true | Save in Business Console ``` ### Technical Analysis The script legitimately needs to send the screening subject's identity data to the declared Didit AML endpoint. However, it does not set the API's `save_api_request` field and provides no command-line control for it. According to `SKILL.md`, the service defaults this option to `true`. Consequently, names, dates of birth, nationalities, document numbers, and tracking identifiers may be stored in the provider's Business Console even when the user only intends to conduct a one-time screening. Date-of-birth and government-document information are particularly sensitive personal data. The transmission itself is not covert exfiltration: it uses HTTPS, targets the documented service, and is central to the Skill's declared purpose. ...[truncated 1528 chars]- Remediation
View remediation