The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/aml_rules_api.py facilitates communication with the Sumsub API by executing the curl binary via subprocess.run. The command is passed as a list of arguments rather than a single string, which is a secure practice that prevents shell injection vulnerabilities. This functionality is a core requirement for the skill's purpose.
[CREDENTIALS_UNSAFE]: The skill requires sensitive authentication tokens and secrets. It correctly instructs users to provide these via environment variables (SUMSUB_APP_TOKEN, SUMSUB_SECRET_KEY) or within the active conversation, which is the standard secure method for handling credentials in this environment. It also includes an explicit check to prevent the accidental use of production tokens unless specifically enabled.
[INDIRECT_PROMPT_INJECTION]: The skill processes AML hit data that originates from external screening vendors. While this represents a data ingestion surface, the risk is mitigated because the data is handled using structured JSON processing within local Python scripts before being presented to the agent, preventing external content from being interpreted as instructions.

sumsub-create-aml-resolution-rules