sumsub-api-generic
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the official Sumsub OpenAPI schema from 'https://api.sumsub.com/agents-openapi.json'. This download is a standard configuration fetch from a well-known service provider and is used to accurately define request and response shapes.
- [COMMAND_EXECUTION]: Provides local Python and Bash scripts to interact with the API. The scripts utilize 'curl' for network requests and 'openssl' for HMAC-SHA256 signature generation, following the vendor's documented authentication requirements.
- [CREDENTIALS_UNSAFE]: API credentials ('SUMSUB_APP_TOKEN' and 'SUMSUB_SECRET_KEY') are managed via environment variables. The 'sumsub_curl.sh' script includes a safety check that restricts the use of credentials to those starting with the 'sbx:' prefix, ensuring only sandbox tokens are used unless explicitly overridden.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (API schema and endpoint responses). The instructions provide mitigation strategies by directing the agent to review payloads with the user and surface only relevant fields from responses, rather than blindly processing or outputting all external content.
Audit Metadata