The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell scripts to perform API requests via curl and generate cryptographic signatures using openssl. Security is maintained by validating list IDs against a hexadecimal regular expression and URL-encoding keys before they are interpolated into request paths, preventing command or path injection.
[DYNAMIC_EXECUTION]: Bash scripts employ python3 -c snippets to handle JSON serialization and parsing. This ensures that data received from the environment or API responses (such as list descriptions or keys) is processed as structured data, avoiding risks associated with shell interpretation.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes content from the Sumsub API that may be user-controlled.
Ingestion points: Data enters the context via API responses in scripts/get_client_lists.sh, scripts/get_client_list.sh, and scripts/get_client_list_values.sh.
Boundary markers: The SKILL.md file contains explicit instructions for the agent to treat list titles, descriptions, and keys as data rather than instructions, and to use quoting when presenting this data to the user.
Capability inventory: The skill can perform network requests to api.sumsub.com, write to the local filesystem, and execute shell commands.
Sanitization: Input validation for list IDs and the use of Python's json library for body construction provide sanitization against malformed or malicious data structures.

sumsub-manage-client-lists