The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses several Bash scripts (get_level.sh, patch_level.sh, post_level.sh) to interact with the Sumsub API using curl. These scripts also utilize openssl for HMAC-SHA256 request signing.
Evidence: The scripts reside in the scripts/ directory and are invoked during the procedure outlined in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied JSON or YAML specifications to build API payloads, which represents an indirect prompt injection surface.
Ingestion points: Data enters the skill's context through scripts/build_level.py via standard input, which is supplied by the agent based on user requests.
Boundary markers: The SKILL.md instructions explicitly require the agent to "Show the resolved payload to the user and ask for explicit confirmation" before performing the first POST operation.
Capability inventory: The skill has the capability to perform network operations (API calls) via the provided Bash scripts and to read/write files as permitted by the allowed-tools configuration.
Sanitization: The scripts/build_level.py script performs schema validation, checking doc-set types, level types, and applicant types against allowed enum sets, and enforcing required fields like name and questionnaireDefId.

sumsub-create-level