The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill communicates with api.sumsub.com to submit transaction data and cockpit.sumsub.com to generate dashboard links. These are official vendor domains and are expected for the skill's functionality.
[COMMAND_EXECUTION]: The post_transaction.sh script executes curl to perform network operations and openssl to generate HMAC-SHA256 signatures for authentication. These commands are used for legitimate API interaction and operate on data validated by a separate Python script.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data from a JSON or YAML specification to construct its API payloads.
Ingestion points: User input provided in the compact spec format described in SKILL.md and processed via scripts/build_transaction.py.
Boundary markers: The skill uses a structured JSON/YAML template for input, providing an implicit boundary for processed data.
Capability inventory: The skill has Write access to create a temporary sidecar routing file and Bash access to execute curl and openssl via scripts/post_transaction.sh.
Sanitization: The build_transaction.py script performs extensive sanitization, including strict enum validation (e.g., type, direction, currencyType), type enforcement (floats for amounts), and URL encoding of dynamic path parameters (applicant ID and level name) before they are passed to the shell script.

sumsub-create-transaction