sumsub-manage-wallet-address-book
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is well-designed with a clear, documented purpose and follows secure coding practices for API integration.
- [CREDENTIALS_UNSAFE]: The skill uses environment variables (
SUMSUB_APP_TOKENandSUMSUB_SECRET_KEY) for authentication. The secret key is used locally for signing requests viaopenssland is never transmitted in plain text or exfiltrated. - [COMMAND_EXECUTION]: Shell scripts (
sumsub_curl.sh,import_wallet_addresses.sh) are used to wrapcurlcommands. These scripts are invoked with controlled arguments from the AI agent and do not present command injection risks. - [EXTERNAL_DOWNLOADS]: No external software or scripts are downloaded at runtime. The skill relies entirely on standard system utilities like
curl,openssl, andpython3. - [DATA_EXFILTRATION]: Network communication is restricted to the official Sumsub API endpoint (
api.sumsub.comor a user-providedSUMSUB_BASE). No data is sent to unauthorized third-party domains. - [OBFUSCATION]: There is no evidence of obfuscated code, hidden URLs, or suspicious character encoding in any of the provided files.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes user-supplied wallet data, it does so through a Python script (
build_wallet_import.py) that performs strict JSON schema validation and data sanitization before the data is sent to the API, effectively mitigating injection risks.
Audit Metadata