Skills
Navigate
skills/sumsub/agent-skills/sumsub-resolve-currency/Gen Agent Trust Hub

sumsub-resolve-currency

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches currency and crypto catalogues from the official vendor API at https://api.sumsub.com. This is a required function for the skill to provide up-to-date asset information.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from external API responses, which constitutes an attack surface for indirect prompt injection.
  • Ingestion points: Currency data is retrieved via get_currencies.sh and parsed by resolve_currency.py.
  • Boundary markers: There are no explicit instructions or delimiters used to separate the external data from the agent's instructions, though the data is handled as structured JSON.
  • Capability inventory: The skill is configured with Bash, Write, and Read capabilities.
  • Sanitization: The resolve_currency.py script normalizes ticker symbols and chains using upper() and strip(), but does not sanitize descriptive fields such as name or contractAddress before they are presented to the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 02:03 PM