ClawHub
Back to skill

Security audit

Didit Liveness Detection

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it handles sensitive face images in a way that may store them with the provider by default without enough user control or warning.

Review this carefully before installing. Only use it with clear consent from the person in the image, avoid putting identifying information in vendor_data, restrict access to the Didit account and API key, and prefer changing the script or requests to set save_api_request=false unless retention is explicitly required.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/check_liveness.py:39
Finding

Biometric Images Are Retained by Default Without an Explicit Opt-Out

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tainted flow: 'headers' from os.environ.get (line 34, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/check_liveness.py (reported line 45)May include surrounding context.

python
with open(user_image, "rb") as f:
        files = {"user_image": (os.path.basename(user_image), f)}
        response = requests.post(API_URL, headers=headers, files=files,
                                 data=data, timeout=60)

    if response.status_code != 200:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill requires environment access for an API key and makes outbound network requests, but it does not declare tool scope such as permissions or allowed-tools. This weakens sandboxing and review controls, making it easier for an agent to use capabilities that were not explicitly disclosed to users or policy enforcement layers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This skill sends a selfie to a third-party biometric verification service and may return sensitive inferred attributes such as age, gender, blocklist status, and duplicate-face matching results, but the description does not warn users about that transmission. Because biometric data is highly sensitive and often regulated, missing disclosure undermines informed consent and can lead to privacy, compliance, and trust failures.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation states that save_api_request defaults to true, which implies uploaded face images and related request data may be retained in the provider's Business Console, but it gives no warning about storage or retention. Silent persistence of biometric submissions increases privacy risk, expands breach exposure, and may violate data minimization expectations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

python
import requests

response = requests.post(
    "https://verification.didit.me/v3/passive-liveness/",
    headers={"x-api-key": "YOUR_API_KEY"},
    files={"user_image": ("selfie.jpg", open("selfie.jpg", "rb"), "image/jpeg")},

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md
formData.append("user_image", selfieFile);
formData.append("face_liveness_score_decline_threshold", "80");

const response = await fetch("https://verification.didit.me/v3/passive-liveness/", {
  method: "POST",
  headers: { "x-api-key": "YOUR_API_KEY" },
  body: formData,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script uploads a biometric face image and optional vendor/session identifier to a third-party service without an explicit runtime warning, consent prompt, or privacy notice. Because face images are highly sensitive personal data, users may disclose biometric information to an external processor without understanding where it is sent or the privacy implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.