ClawHub
Back to skill

Security audit

Didit Email Verification

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it helps verify emails through Didit, with some expected privacy and dependency-supply-chain considerations.

Install only if you intend to send email verification data to Didit. Use a dedicated, least-privilege Didit API key, avoid optional fraud signals unless needed, get appropriate consent for personal data, and prefer a pinned dependency file or isolated virtual environment for the Python helper script.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:317
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 317
Vulnerability Type: Unpinned third-party dependency and insufficient supply-chain controls
Risk Level: Medium

Vulnerable Code

bash
# Requires: pip install requests
export DIDIT_API_KEY="your_api_key"

The project instructs users to install requests without specifying a reviewed version, cryptographic hash, lockfile, or trusted package index. The project directory contains no dependency manifest that otherwise constrains or verifies this package.

Technical Analysis

An unconstrained pip install requests command resolves whichever compatible release is available from the configured package index at installation time. Consequently, the installed code may differ from the code reviewed when this Skill was published.

This creates a supply-chain risk if the upstream package or package-distribution account is compromised, if a malicious package index is configured, or if package resolution is intercepted or redirected. The script imports the dependency at scripts/verify_email.py:20 and subsequently provides it with sensitive request headers and payloads. A malicious dependency could therefore execute code during import or request processing.

The legitimate script sends the Didit API key, email addresses, OTP values, and optional vendor tracking data only to the fixed HTTPS Didit endpoint. That disclosure is necessary for the declared verification functionality and does not itself exceed minimum privilege. The dependency installation process, however, lacks controls ensuring that the code handling those values is the reviewed dependency version.

Attack Path

  1. An attacker compromises the upstream package distribution channel, influences the configured Python package index, or otherwise causes dependency resolution to return a malicious release.
  2. A user follows the documented pip install requests instruction without a version or hash ...[truncated 1181 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the unconstrained installation instruction with a dependency manifest that pins a specifically reviewed version:
    text
    requests==<reviewed-version>
  2. Generate and enforce cryptographic hashes for the package and its transitive dependencies, for example:
    bash
    python -m pip install --require-hashes -r requirements.txt
  3. Commit a lockfile or fully resolved requirements file so installations use the same reviewed dependency graph.
  4. Explicitly use the official Python Package Index or an organization-controlled mirror:
    bash
    python -m pip install --index-url https://pypi.org/simple --require-hashes -r requirements.txt
  5. Review and update pinned dependencies through a controlled process that includes vulnerability scanning, provenance verification, and testing before deployment.
  6. Run the script in a minimally privileged virtual environment or container, and expose only the required DIDIT_API_KEY and necessary network access.
  7. Rotate the API key immediately if dependency compromise is suspected, and review Didit account usage for unauthorized requests or credit consumption.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill requires environment access for DIDIT_API_KEY and clearly performs outbound network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and can cause the runtime or user to underestimate what capabilities the skill will exercise, especially when handling email addresses and fraud-signal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends sensitive user data to a third-party service, including email addresses and optional fraud signals such as IP address, device ID, and user agent, but the description does not prominently warn users about that external transmission. This creates a privacy and consent risk because operators may invoke the skill without understanding that personal and tracking-related data leaves the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

python
import requests

response = requests.post(
    "https://verification.didit.me/v3/email/send/",
    headers={"x-api-key": "YOUR_API_KEY", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

python
import requests

response = requests.post(
    "https://verification.didit.me/v3/email/send/",
    headers={"x-api-key": "YOUR_API_KEY", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

python
import requests

response = requests.post(
    "https://verification.didit.me/v3/email/send/",
    headers={"x-api-key": "YOUR_API_KEY", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

text

```typescript
const response = await fetch("https://verification.didit.me/v3/email/send/", {
  method: "POST",
  headers: { "x-api-key": "YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

Example

python
response = requests.post(
    "https://verification.didit.me/v3/email/check/",
    headers={"x-api-key": "YOUR_API_KEY", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

text

```typescript
const response = await fetch("https://verification.didit.me/v3/email/check/", {
  method: "POST",
  headers: { "x-api-key": "YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends email addresses and OTP codes to a third-party API endpoint, which is inherently sensitive identity and authentication data. While this is core to the skill’s purpose, the implementation provides no explicit user-facing disclosure, consent prompt, or minimization guidance, so users or integrators may unknowingly expose personal data and verification secrets to an external processor.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.