T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/verify_address.py:37
- Finding
- Proof-of-address documents are retained by the third-party service by default## Vulnerability Details **File Location**: `scripts/verify_address.py:37-42` **Related Documentation**: `SKILL.md:85` **Vulnerability Type**: Privacy-sensitive third-party data retention **Risk Level**: Medium The Skill documentation states that the `save_api_request` parameter defaults to `true`: ```text | `save_api_request` | boolean | No | `true` | Save in Business Console | ``` The request code does not override that default: ```python data = {} if vendor_data: data["vendor_data"] = vendor_data r = requests.post(ENDPOINT, headers={"x-api-key": api_key}, files=files, data=data, timeout=60) ``` ### Technical Analysis Proof-of-address documents may contain names, residential addresses, account information, transaction details, customer identifiers, and other personal or financial data. The script submits these documents to Didit without setting `save_api_request` to `false`. According to the included documentation, omission of this parameter causes the request to be saved in the Didit Business Console. Remote submission is necessary for the declared verification functionality, but persistent retention is not demonstrated to be necessary. Accepting retention by default therefore exceeds the minimum data-handling privileges needed to perform a verification request. This is not covert exfiltration: the destination is a fixed HTTPS endpoint belonging to the declared verification provider, and the uploaded document is required for the service. The security concern is avoidable retention after processing. ### Attack Path 1. A user invokes the script with a utility bill, bank statement, government record, or similar proof-of-address document. 2. The script uploads the complete document to `https://verification.didit.me/v3/poa/`. 3. The script omits `save_api_request`, causing the documented default value of `true` to apply. 4. The request and associated document are retained in the th ...[truncated 726 chars]
- Remediation
- ## Remediation Suggestions - Set `save_api_request` to `false` for every request by default: ```python data = {"save_api_request": "false"} if vendor_data: data["vendor_data"] = vendor_data ``` - Add an explicit opt-in option such as `--save-api-request` for workflows that genuinely require console retention. - Before enabling retention, display or document a clear warning describing what is stored, why it is stored, who can access it, and how long it is retained. - Document deletion procedures and the vendor's retention controls. - Apply data-minimization and consent requirements appropriate to proof-of-address documents. - Restrict access to retained requests in the Didit Business Console using least-privilege roles and account security controls.