sumsub-create-level
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses utility scripts (
get_level.sh,patch_level.sh,post_level.sh) to perform network requests to the Sumsub API (api.sumsub.com) usingcurl. These scripts also utilizeopensslfor HMAC-SHA256 request signing. These operations are essential for the skill's functionality and target the vendor's official API. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided specifications and external data from other skills (entitlements) or API responses (existing levels). While this represents an attack surface for indirect prompt injection, it is mitigated by the structured nature of the tasks and the use of a validation builder (
build_level.py) before API submission.
Audit Metadata