The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local shell and Python scripts to prepare and send API requests. These scripts include security measures such as URL-encoding user input in shell arguments and using --data-binary in curl to safely handle JSON payloads without shell interference.
[EXTERNAL_DOWNLOADS]: Network operations are directed exclusively to Sumsub's official API domain (api.sumsub.com). This communication is the core intended purpose of the skill and aligns with the vendor's provided services.
[CREDENTIALS_UNSAFE]: The skill manages sensitive API tokens via environment variables. It incorporates a validation logic to ensure that only sandbox credentials (identifiable by the sbx: prefix) are used, reducing the risk of unintended production environment access. The instructions explicitly forbid the agent from repeating these secrets to the user.
[INDIRECT_PROMPT_INJECTION]: The skill handles user-provided questionnaire specifications which are processed through a conversion script.
Ingestion points: User-provided spec files (JSON/YAML) ingested via standard input to the builder script.
Boundary markers: The procedure requires a validation and inspection phase before the payload is sent to the API.
Capability inventory: Network communication via curl, file system interaction for temp files, and cryptographic signing via openssl.
Sanitization: The build_questionnaire.py script employs yaml.safe_load() and json.dump() for parsing and generation, which prevents the execution of malicious instructions during the data transformation process.

sumsub-create-questionnaire