The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes webhook metadata, such as names and descriptions, from the Sumsub API and displays it to the agent, creating a surface for indirect prompt injection.
Ingestion points: API responses from /resources/api/clientWebhooks are ingested by scripts/manage_webhooks.sh and displayed to the agent.
Boundary markers: Absent; the output does not use delimiters or specific warnings to isolate external data from agent instructions.
Capability inventory: The skill utilizes curl, openssl, and python3 via Bash for network operations and data processing.
Sanitization: The create and update output paths use Python's repr() for basic sanitization, but the list path prints metadata directly, which may allow semantic injection.
[DYNAMIC_EXECUTION]: The manage_webhooks.sh script executes Python logic for data formatting and filtering by passing code through heredocs (`python3
<<'PY') and command-line strings (python3 -c "..."`). While the embedded code templates are static, this method involves runtime execution of embedded scripts.
[COMMAND_EXECUTION]: The skill performs shell command execution via Bash to interact with the Sumsub API and perform cryptographic signing using openssl. This is an intended capability but is a primary component of the skill's operation.

sumsub-manage-webhooks