The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local Bash scripts (manage_applicant_tags.sh and sumsub_curl.sh) to perform API calls and data processing. These scripts use Python for safe JSON handling and OpenSSL for request signing.
[EXTERNAL_DOWNLOADS]: Communicates with the vendor's official API endpoint (api.sumsub.com) to manage applicant data. This is the primary function of the skill and follows standard API integration patterns.
[CREDENTIALS_UNSAFE]: Requires SUMSUB_APP_TOKEN and SUMSUB_SECRET_KEY via environment variables. The skill includes a proactive security check that rejects production tokens (lacking the sbx: prefix) unless specifically overridden by the user.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Fetches applicant profiles, including names and existing tags, from the API via GET /resources/applicants/{applicantId}/one as documented in scripts/manage_applicant_tags.sh.
Boundary markers: No specific delimiters are used when displaying retrieved applicant data to the agent.
Capability inventory: The skill utilizes Bash and Write tools to modify applicant tags and interact with the filesystem for temporary request signing.
Sanitization: Data sent to the API is JSON-encoded to prevent command injection at the API layer, though retrieved string data is not filtered for embedded instructions.

sumsub-manage-applicant-tags