The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill incorporates the @sumsub/fisherman library and communicates with Sumsub's official API endpoints.
Evidence:
Installation instructions for @sumsub/fisherman via npm and imports from https://esm.sh/@sumsub/fisherman.
Communication with https://api.sumsub.com for token minting and event confirmation.
These resources are legitimate vendor services provided by Sumsub.
[COMMAND_EXECUTION]: The skill includes shell scripts to assist the user and agent in validating and configuring the integration.
Evidence:
scripts/preflight.sh validates workspace settings and HMAC signing capabilities.
examples/behavior-token.sh and examples/submit-platform-event.sh demonstrate server-side API interactions.
The operations performed (e.g., using curl, openssl, and python3) are transparent and scoped to the intended integration task.
[INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface for indirect prompt injection as it requires the agent to read and modify the user's codebase.
Evidence:
Ingestion points: The agent reads the user's repository files (routes, controllers, and frontend components) to determine where to hook the Device Intelligence logic.
Boundary markers: The skill provides structured instructions and stages, guiding the agent to follow existing repository conventions.
Capability inventory: The skill utilizes Read, Write, and Bash tools to modify the application and execute validation scripts.
Sanitization: The skill emphasizes standard security practices like server-side confirmation and best-effort frontend execution, which mitigates the impact of potential malicious data processed during the integration.

sumsub-integrate-dint-standalone