didit-fraud-networks
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to the vendor's official domains (
verification.didit.meandapx.didit.me) to retrieve fraud network data, manage organization settings, and perform programmatic account registration. It also includes functionality to download and save PDF reports to the local file system. - [COMMAND_EXECUTION]: Provides a utility script,
scripts/list_networks.py, which is intended for command-line interaction with the Didit API. The script uses standard libraries to process arguments and perform authorized HTTP requests. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from fraud detection clusters, which may contain attacker-influenced signals (e.g., user-provided email or phone metadata).
- Ingestion points: The skill fetches network details, member lists, and signal data from the
verification.didit.meAPI endpoints. - Boundary markers: No explicit boundary markers or instructions to ignore embedded content were found in the provided documentation.
- Capability inventory: The skill has the capability to write files (
network-report.pdf) and perform network operations via the included Python script. - Sanitization: No explicit sanitization or filtering of the external API responses is observed in the provided utility script, which outputs raw JSON to the console.
Audit Metadata