The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes helper scripts (sumsub_curl.sh, sumsub_sign.py) that execute shell commands such as curl and openssl to interact with the Sumsub API.
[DATA_EXFILTRATION]: The skill is designed to send authenticated requests to api.sumsub.com. While this involves transmitting API tokens and request data, it is the intended primary purpose of the skill and targets legitimate vendor infrastructure.
[INDIRECT_PROMPT_INJECTION]: The signing process ingests external data (HTTP methods, paths, and request bodies) which may be controlled by untrusted sources during agent interaction.
Ingestion points: Request parameters and bodies are read from command line arguments, standard input, or local files in scripts/sumsub_sign.py and scripts/sumsub_curl.sh.
Boundary markers: The skill does not explicitly define delimiters for untrusted data processed during the signing phase, relying on standard signing logic.
Capability inventory: The agent has access to Bash, Read, and Write tools, along with the ability to perform network operations via curl and the provided scripts.
Sanitization: Basic transformations like converting HTTP methods to uppercase are performed, but the request path and body are processed as raw bytes for signing accuracy, which is required for authentication functionality.

sumsub-api-auth