ClawHub
Back to skill

Security audit

Didit Id Document Verification

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it handles government ID data with under-scoped defaults that could expose or retain sensitive personal information.

Review carefully before installing. Use only with informed consent from the document holder, prefer --no-save unless retention is explicitly required, avoid putting personal data in vendor_data, and do not run the helper script in transcripts, CI logs, or shared terminals unless sensitive output is redacted.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/verify_id.py:25
Finding

Unrestricted Local File Upload to an External Verification Service

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/verify_id.py:66
Finding

Complete Identity Verification Response Printed to Standard Output

Content
View full analysis
Remediation
View remediation

other

Note
Location
scripts/verify_id.py:18
Finding

Remote Retention of Identity Verification Requests Enabled by Default

Content
View full analysis
dict: ``` ```python data = {"save_api_request": str(save).lower()} ``` ```python parser.add_argument("--no-save", action="store_true", help="Don't save request in Business Console") args = parser.parse_args() result = verify_id(args.front_image, args.back_image, args.vendor_data, save=not args.no_save) ``` ### Technical Analysis The `save` parameter defaults to `True`, and the command-line interface only disables storage when the user explicitly supplies `--no-save`. As a result, the basic commands documented in `SKILL.md` cause verification requests to be saved in the Didit Business Console. Remote processing is necessary for the Skill's declared functionality, but remote persistence is a separate capability and is not strictly required to obtain a verification result. Enabling retention by default therefore exceeds the minimum data-handling scope necessary for verification. The behavior is disclosed through the API parameter documentation and command-line option, so it is not covert exfiltration. The concern is that the default is not privacy-preserving for highly sensitive identity documents. ### Attack Path 1. A user follows the basic documented invocation without adding `--no-save`. 2. The command-line parser leaves `args.no_save` set to `False`. 3. The script converts this to `save=True`. 4. The request sends `save_api_request=true` to the Didit API. 5. The identity verification request is retained in the remote Business Console and remains accessible according to the provider's access and retention controls. ### Impact Assessment The default increases the duration and number of locations in which identity document ...[truncated 394 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tainted flow: 'headers' from os.environ.get (line 38, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/verify_id.py (reported line 48)May include surrounding context.

python
if back_image:
            with open(back_image, "rb") as back_f:
                files["back_image"] = (os.path.basename(back_image), back_f)
                response = requests.post(API_URL, headers=headers, files=files,
                                         data=data, timeout=60)
        else:
            response = requests.post(API_URL, headers=headers, files=files,

Tainted flow: 'headers' from os.environ.get (line 38, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/verify_id.py (reported line 51)May include surrounding context.

python
if back_image:
            with open(back_image, "rb") as back_f:
                files["back_image"] = (os.path.basename(back_image), back_f)
                response = requests.post(API_URL, headers=headers, files=files,
                                         data=data, timeout=60)
        else:
            response = requests.post(API_URL, headers=headers, files=files,

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The documented save_api_request parameter defaults to true, meaning sensitive identity documents and related request data may be retained server-side unless the caller explicitly disables it. Enabling retention by default without a clear warning materially increases privacy exposure, breach impact, and regulatory risk for especially sensitive KYC document data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill requires environment access to an API key and performs outbound network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can cause the runtime or reviewer to underappreciate the skill's ability to exfiltrate sensitive identity data to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This skill transmits highly sensitive identity-document images and extracted PII to a third-party verification service, yet it provides no explicit warning about privacy implications or the need for informed user consent. Because the data includes government IDs, portraits, MRZ data, addresses, and dates of birth, silent transmission can create serious privacy, compliance, and trust risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

python
import requests

response = requests.post(
    "https://verification.didit.me/v3/id-verification/",
    headers={"x-api-key": "YOUR_API_KEY"},
    files={

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
formData.append("back_image", backImageFile);
formData.append("vendor_data", "user-123");

const response = await fetch("https://verification.didit.me/v3/id-verification/", {
  method: "POST",
  headers: { "x-api-key": "YOUR_API_KEY" },
  body: formData,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script transmits highly sensitive identity document images to a third-party verification service but provides no explicit runtime warning, consent check, or privacy notice before upload. In the context of KYC and document verification, this is expected functionality, but the sensitivity of passports and IDs makes undisclosed external transfer a meaningful privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

Optional vendor/session metadata is forwarded to the third-party API without any warning about disclosure or guidance to avoid placing sensitive personal data in that field. While less severe than uploading the document images themselves, this can still leak internal identifiers or user-linked metadata to an external processor.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.