sumsub-check-skills-version

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses curl to fetch a public version manifest from https://api.sumsub.com/llms.txt. This is a standard version check against the vendor's own infrastructure and involves no sensitive data or credentials.
  • [COMMAND_EXECUTION]: The skill executes local bash scripts (check_version.sh and render_headsup.sh) to compare version strings and manage a local cache file (.headsup_cache). These scripts are self-contained and perform legitimate version management logic.
  • [REMOTE_CODE_EXECUTION]: While the skill downloads content from a remote URL, it only parses version strings using grep and sed. It does not execute the downloaded content as code or pipe it to a shell.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 09:10 PM
Security Audit — agent-trust-hub — sumsub-check-skills-version