sumsub-integrate-websdk
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Sumsub WebSDK builder from the vendor's official CDN at
static.sumsub.com. This is an expected and legitimate resource for the skill's stated purpose. - [COMMAND_EXECUTION]: Includes Bash command recipes using
curlandopensslto demonstrate how to perform HMAC-SHA256 signing for API requests. These snippets are provided as implementation guides for the user. - [SAFE]: The skill advocates for critical security practices, such as verifying webhook signatures on raw request bytes using timing-safe comparisons to prevent timing attacks.
- [SAFE]: Instructions correctly advise developers to use sandbox credentials during the integration phase to prevent exposure of production data.
Audit Metadata