didit-kyc-onboarding
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documentation and provided script implement a standard integration with the Didit identity verification platform. No malicious patterns such as prompt injection, obfuscation, or persistence mechanisms were detected.
- [EXTERNAL_DOWNLOADS]: The script requires the 'requests' library, which is a standard and well-known Python package used for HTTP communication.
- [DATA_EXPOSURE]: The skill manages authentication via the 'DIDIT_API_KEY' environment variable, which is a standard practice for protecting secrets. All network communication is directed to the vendor's official domains (didit.me).
- [INDIRECT_PROMPT_INJECTION]: The skill processes identity data returned from the Didit API (e.g., names, document details). While this constitutes an attack surface where untrusted data enters the agent context, the skill does not possess dangerous capabilities like 'exec' or 'eval' that could be exploited by such data, and it only performs predefined network operations to the vendor's API.
- Ingestion points: scripts/run_kyc.py (API responses from verification.didit.me)
- Boundary markers: None
- Capability inventory: Network operations via 'requests' library
- Sanitization: Standard JSON parsing and string interpolation for terminal output
Audit Metadata