sumsub-integrate-id-connect

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the @sumsub/id-connect JavaScript library hosted on unpkg.com, a well-known and standard content delivery network for public packages. This dependency is authored by the same vendor as the skill.
  • [COMMAND_EXECUTION]: The scripts/preflight.sh script uses curl to verify connectivity and configuration with Sumsub's official OIDC and API endpoints. It also utilizes python3 locally to parse JSON responses from these diagnostic checks. These actions are limited to environment validation.
  • [DATA_EXFILTRATION]: The backend implementation (examples/express-callback.js) performs authorized requests to Sumsub's API to facilitate the identity sharing flow. These operations utilize HMAC signing and OIDC protocols as intended for the service's functionality, with credentials managed via environment variables.
  • [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data through OAuth authorization codes and tokens. The provided backend examples include sanitization measures, such as HTML escaping, to prevent malicious content in these fields from impacting the user interface.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 09:35 PM
Security Audit — agent-trust-hub — sumsub-integrate-id-connect