sumsub-create-poa-preset
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses several Bash utility scripts (
get_poa_preset.sh,post_poa_preset.sh,patch_poa_preset.sh) to perform operations. These scripts execute standard system commands such ascurlfor API communication andopensslto compute HMAC-SHA256 signatures for authentication. - [DATA_EXFILTRATION]: The skill transmits configuration data to the official Sumsub API domain (
api.sumsub.com). The transmission is restricted to Proof-of-Address preset settings as per the skill's primary purpose. It incorporates a security check that rejects App Tokens missing thesbx:prefix to prevent accidental use of production credentials. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied configuration specs (JSON/YAML) to generate API requests. The
build_poa_preset.pyscript usesyaml.safe_load()and performs strict validation of enums, ISO country codes, and data structures, effectively sanitizing input before it is used in API payloads.
Audit Metadata