T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/estimate_age.py:30
- Finding
- Biometric request retention is enabled by default## Vulnerability Details **File Location**: `scripts/estimate_age.py:30-48`; retention default documented at `SKILL.md:85` **Vulnerability Type**: Failure to minimize biometric data retention **Risk Level**: Medium ### Evidence The API documentation states that omitted `save_api_request` values default to `true`: ```markdown | `save_api_request` | boolean | No | `true` | Save in Business Console Manual Checks | ``` The request does not override that default: ```python def estimate_age(image_path: str, rotate: bool = False, vendor_data: str = None) -> dict: api_key = get_api_key() with open(image_path, "rb") as f: files = {"user_image": (os.path.basename(image_path), f, "image/jpeg")} data = {} if rotate: data["rotate_image"] = "true" if vendor_data: data["vendor_data"] = vendor_data r = requests.post(ENDPOINT, headers={"x-api-key": api_key}, files=files, data=data, timeout=60) if r.status_code not in (200, 201): print(f"Error {r.status_code}: {r.text}", file=sys.stderr) sys.exit(1) return r.json() ``` ### Technical Analysis The Skill must transmit a facial image to the declared Didit service to perform cloud-based age estimation. That transmission is necessary for the stated functionality. Retaining the request in the Didit Business Console, however, is not required to calculate the result. Because the script omits `save_api_request`, the service applies its documented default of `true`. Users therefore receive no explicit choice before their facial image and associated request are retained. Facial images are sensitive biometric data, so this behavior violates data-minimization and least-retention principles. ### Attack Path 1. A user invokes the script with a facial image. 2. The script uploads the image without setting `save_api_request`. 3. The service applies the ...[truncated 622 chars]
- Remediation
- ## Remediation Suggestions Set `save_api_request` to `false` on every request by default: ```python data = {"save_api_request": "false"} ``` If retention is operationally necessary, expose it through an explicit opt-in option such as `--save-api-request`. Before enabling it, clearly disclose what data will be retained, who can access it, the retention duration, and how deletion can be requested. Apply least-privilege access controls and short retention policies in the Business Console.