Didit Database Validation

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:01 PM UTC
• Version: 1.1.0

Overview

This skill sends user-provided identity details to Didit's documented verification API, which is sensitive but coherent with its stated purpose and not hidden.

Install only if you intend to send identity data to Didit for verification. Use a dedicated API key, avoid logging full identifiers or DOBs, confirm you have consent or another lawful basis to process the data, and install Python dependencies in an isolated environment with pinned versions where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:261

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 261-264
Vulnerability Type: Supply-chain risk from an unpinned dependency
Risk Level: Low

Vulnerable Code:

bash

# Requires: pip install requests
export DIDIT_API_KEY="your_api_key"
python scripts/validate_database.py --id-number 12345678 --country PER --first-name Carlos --last-name Garcia
python scripts/validate_database.py --id-number GARC850315HDFRRL09 --country MEX

Technical Analysis

The installation instruction requests the latest resolvable version of requests without a version constraint, lockfile, package hash, or trusted-index restriction. Consequently, the dependency selected during installation can differ from the version reviewed or tested by the Skill author.

This does not establish that the legitimate requests package is malicious. The risk arises if a package release, configured package index, dependency in the resolved graph, or package-distribution account is compromised. Python package installation may execute package build logic, and imported package code runs with the privileges of the user invoking the validation script.

Attack Path

1. An attacker compromises a dependency release, package distribution account, package index, or dependency resolved by the unpinned installation.
2. A user follows the documented pip install requests instruction.
3. pip resolves and installs the compromised distribution because no audited version or hash is required.
4. Malicious code executes during package installation or when validate_database.py imports requests.
5. The malicious package inherits the invoking user's privileges and may access process-readable data, including DIDIT_API_KEY when the script runs.

Impact Assessment

Successful exploitation could execute arbitrary code with the permissions of the user running pip or the validation script. Depending on that user's privileges, the attacker coul ...[truncated 384 chars]

Remediation

View remediation

Remediation Suggestions

• Pin requests and its transitive dependencies to versions that have been reviewed and tested.
• Maintain the dependency set in a lockfile generated by a tool such as pip-tools.
• Require cryptographic package hashes during installation, for example through a hashed requirements file and pip install --require-hashes -r requirements.txt.
• Install dependencies in an isolated virtual environment rather than a system-wide or privileged environment.
• Use an explicitly trusted package index and avoid unreviewed mirrors or environment-controlled index overrides.
• Regularly scan and update pinned dependencies through a controlled review process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tainted flow: 'api_key' from os.environ.get (line 26, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/validate_database.py (reported line 48)May include surrounding context.

python

payload["date_of_birth"] = date_of_birth
    if vendor_data:
        payload["vendor_data"] = vendor_data
    r = requests.post(ENDPOINT,
                      headers={"x-api-key": api_key, "Content-Type": "application/json"},
                      json=payload, timeout=60)
    if r.status_code not in (200, 201):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill uses environment secrets and network access to transmit identity data to an external API, but it does not declare explicit tool scope such as allowed tools or permissions. That weakens sandboxing and reviewability, increasing the risk of unintended capability use or secret exposure if the skill is invoked in a broader agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This skill sends highly sensitive personal identity data, including national ID numbers, names, and possibly dates of birth, to a third-party verification service without a prominent user-facing warning or consent notice. The main danger is privacy harm, regulatory noncompliance, and accidental disclosure of government-ID data to an external processor when users may not realize the transmission occurs.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This duplicate finding points to the same Python example showing structured transmission of sensitive identity data and API credentials to a remote host. Even though the destination appears legitimate and aligned with the skill purpose, the operation remains dangerous if used without user awareness, policy controls, or secure handling of PII.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

python

import requests

response = requests.post(
    "https://verification.didit.me/v3/database-validation/",
    headers={"x-api-key": "YOUR_API_KEY", "Content-Type": "application/json"},
    json={

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This duplicate finding points to the same Python example showing structured transmission of sensitive identity data and API credentials to a remote host. Even though the destination appears legitimate and aligned with the skill purpose, the operation remains dangerous if used without user awareness, policy controls, or secure handling of PII.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

python

import requests

response = requests.post(
    "https://verification.didit.me/v3/database-validation/",
    headers={"x-api-key": "YOUR_API_KEY", "Content-Type": "application/json"},
    json={

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The TypeScript example also performs external transmission of highly sensitive personal identity data to a third-party endpoint. This is consistent with the skill's purpose, but the context makes the privacy and compliance risk higher because the skill is specifically designed for government-database identity lookups using regulated personal data.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

text

```typescript
const response = await fetch("https://verification.didit.me/v3/database-validation/", {
  method: "POST",
  headers: { "x-api-key": "YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/validate_database.py (reported line 48)May include surrounding context.

python

payload["date_of_birth"] = date_of_birth
    if vendor_data:
        payload["vendor_data"] = vendor_data
    r = requests.post(ENDPOINT,
                      headers={"x-api-key": api_key, "Content-Type": "application/json"},
                      json=payload, timeout=60)
    if r.status_code not in (200, 201):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script transmits highly sensitive identity data such as ID numbers, names, and dates of birth to a third-party verification service without any explicit runtime warning, consent check, or privacy notice. In a skill designed for government-database identity verification this transmission is expected, but the data category is especially sensitive, so failing to clearly disclose sharing and obtain appropriate authorization creates real privacy and compliance risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.