sumsub-integrate-dint-websdk
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices by instructing users to use environment variables for sensitive API credentials (
SUMSUB_APP_TOKEN,SUMSUB_SECRET_KEY) rather than hardcoding them in scripts or configuration files. - [SAFE]: Included shell scripts and instructions explicitly enforce a "sandbox-only" policy for integration work by checking for the
sbx:prefix on App Tokens, reducing the risk of accidental production data exposure during the development phase. - [SAFE]: All external dependencies (
@sumsub/fisherman) and network communications (api.sumsub.com) are directed to the official Sumsub vendor infrastructure, consistent with the skill's stated purpose and intended functionality. - [SAFE]: The TypeScript implementation for self-rendered integration follows a robust lifecycle management pattern (init, destroy, fingerprint) with proper error handling and re-initialization logic to ensure Device Intelligence failures do not block the primary user verification flow.
Audit Metadata