The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes Bash and Python scripts to process user data and communicate with the Sumsub API. Specifically, sumsub_curl.sh uses curl to transmit data, and build_wallet_import.py handles JSON data transformation.
[CREDENTIALS_UNSAFE]: The skill manages SUMSUB_APP_TOKEN and SUMSUB_SECRET_KEY through environment variables. The sumsub_curl.sh script follows security best practices by using the secret key to generate an HMAC-SHA256 signature locally rather than transmitting the secret itself. It also implements a safety check to prevent the accidental use of production tokens unless explicitly authorized via SUMSUB_ALLOW_PROD=1.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied crypto wallet data, which serves as a potential surface for indirect prompt injection if the data is maliciously crafted.
Ingestion points: scripts/build_wallet_import.py ingests JSON-formatted wallet specifications from standard input.
Boundary markers: The skill relies on structured JSON parsing and instructions to the agent to maintain data boundaries, though no specific delimiters are enforced within the individual address fields.
Capability inventory: The skill has the capability to write to temporary files (mktemp in sumsub_curl.sh), execute cryptographic tools (openssl), and perform network POST operations via curl to api.sumsub.com.
Sanitization: Input is validated in build_wallet_import.py for schema correctness, address presence, and the Sumsub API's batch limit of 10,000 entries per call.

sumsub-manage-wallet-address-book