didit-document-ai
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a standard API integration for document analysis and does not exhibit any malicious patterns.
- [DATA_EXFILTRATION]: The skill transmits document files and metadata to the vendor's API endpoints (didit.me) for extraction. This is the primary intended functionality of the skill and occurs over HTTPS to the author's infrastructure.
- [CREDENTIALS_UNSAFE]: The skill follows security best practices by requiring the API key to be provided via environment variables (DIDIT_API_KEY) rather than being hardcoded in the source files.
- [INDIRECT_PROMPT_INJECTION]: The skill provides an interface where the AI agent defines 'instructions' for the Document AI model and processes document content. While this represents a theoretical attack surface common to OCR and Document AI tools, the skill itself provides standard delimiters and structure for these interactions.
Audit Metadata