sumsub-check-permissions
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script (
check_permissions.sh) via the Bash tool to interact with the vendor's API. The script uses standard system utilities includingopensslfor HMAC-SHA256 signature generation andcurlfor secure network communication. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves configuration data from an external source (Sumsub API) which is then parsed by the agent.
- Ingestion points: Data is fetched from
api.sumsub.comwithinscripts/check_permissions.sh. - Boundary markers: The script explicitly appends the HTTP status code to the output to help the agent distinguish the response body from execution metadata.
- Capability inventory: The skill uses
curlfor network access to vendor endpoints andopensslfor cryptographic signing. - Sanitization: Instructions in
SKILL.mdmandate that the agent must verify the HTTP 200 status and confirm the presence of specific keys within the returned JSON map before taking further actions.
Audit Metadata