sumsub-integrate-id-connect
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the
@sumsub/id-connectJavaScript library hosted onunpkg.com, a well-known and standard content delivery network for public packages. This dependency is authored by the same vendor as the skill. - [COMMAND_EXECUTION]: The
scripts/preflight.shscript usescurlto verify connectivity and configuration with Sumsub's official OIDC and API endpoints. It also utilizespython3locally to parse JSON responses from these diagnostic checks. These actions are limited to environment validation. - [DATA_EXFILTRATION]: The backend implementation (
examples/express-callback.js) performs authorized requests to Sumsub's API to facilitate the identity sharing flow. These operations utilize HMAC signing and OIDC protocols as intended for the service's functionality, with credentials managed via environment variables. - [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data through OAuth authorization codes and tokens. The provided backend examples include sanitization measures, such as HTML escaping, to prevent malicious content in these fields from impacting the user interface.
Audit Metadata