sumsub-supported-id-documents

The script's intended function is an authenticated entitlement lookup. The direct interpolation of the entitlement argument into Python source creates a command-line code-injection vulnerability. The unrestricted SUMSUB_BASE override can also send the App Token and signature to an unintended host. No clear malicious behavior is evident, but both issues warrant remediation.