sumsub-manage-webhooks
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is well-designed with security in mind and contains no malicious code or instructions. It includes validation logic to ensure users do not inadvertently configure webhooks with unreachable local targets.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses (webhook configurations from Sumsub). While this represents a potential injection surface, the risk is mitigated by using rigid JSON parsing and specific field extraction in formatting scripts (e.g.,
fmt_listandmanage_webhooks.shlogic) rather than raw interpolation of external content into the agent prompt. - [CREDENTIALS_UNSAFE]: The skill follows secure credential management practices by using environment variables. It additionally implements a proactive redaction step in the
getcommand to ensure that webhook secrets returned by the API are not displayed in the conversation history. - [DATA_EXFILTRATION]: Network operations are restricted to the official vendor domain (
api.sumsub.com). No unauthorized data exfiltration patterns were detected.
Audit Metadata