didit-kyc-onboarding
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: Fetches sensitive personally identifiable information (PII), including full names, dates of birth, and document identification numbers, from the Didit verification API. This data collection is the primary purpose of the skill and is directed to the vendor's own infrastructure.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes verification result data from an external source, presenting an attack surface for indirect prompt injection.
- Ingestion points: The
get_decisionfunction inscripts/run_kyc.pyand the poll loop inSKILL.mdexamples ingest data from the Didit API decision endpoint. - Boundary markers: Absent; retrieved PII data is printed directly to the output without delimiters or warnings.
- Capability inventory: Performs network requests using the
requestslibrary and reads theDIDIT_API_KEYenvironment variable. - Sanitization: None; the skill relies on the API provider for data integrity and does not sanitize or validate the content of the API response before display.
Audit Metadata