skill CX Codex

sumsub-conformance — Claude Code skill: check a Sumsub config against a regulation

Q: How do I install sumsub-conformance in Claude Code?

Run `npx skills add sumsub/agent-skills --skill sumsub-conformance -a claude-code`. The skill lands at `~/.claude/skills/sumsub-conformance/SKILL.md`.

Q: Which Sumsub token does the skill need?

A sandbox pair: `SUMSUB_APP_TOKEN` starting with `sbx:` plus the matching `SUMSUB_SECRET_KEY`. Production tokens are rejected by the helper.

Walks a live Sumsub configuration and answers one question per requirement: is it collected, scored, enforced? Flags the items that are gathered and scored but never acted on.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓

npx skills add sumsub/agent-skills --skill sumsub-conformance -a claude-code

Open on GitHub

What sumsub-conformance does

Point the skill at a requirements document — PDF or plain text — and it lines that document up against a tenant's deployed Sumsub configuration. Each requirement gets traced through the config graph to the place where the data is collected, where it is scored, and where something actually happens because of it. The finding it surfaces is the collected-but-not-enforced case: a questionnaire that gets scored and then routes nowhere.

Everything runs against read-only Sumsub endpoints, signed with App-Token HMAC. resolve_graph.sh builds the graph, trace.py and report.py produce the verdict, and python3 scripts/graph_summary.py "$CONFIG" prints the section and item indices when you want to look at the graph yourself. Output files land next to the regulation you fed in, named from its stem: <stem>_regulations.json, <stem>_config.json, <stem>_report.md.

You need SUMSUB_APP_TOKEN and SUMSUB_SECRET_KEY. Sandbox only — the helper turns down any token that does not start with sbx:, so a production pair has to be swapped out before the run. When the graph cannot be resolved the script stops there, and no verdict comes out of a partial graph. Treat the output as a gap report rather than a compliance guarantee: semantic intent and whatever the SDK does downstream still need a human to sign off.

What it helps with

verify that every clause of a regulation is actually enforced in a tenant's config
spot questionnaires and checks that collect data without acting on it
close the generate-then-verify loop after building config with sumsub-create-*
audit a client's setup against compliance rules
get a per-requirement report instead of eyeballing workflow JSON

Example prompts for the agent

Here's Level4regulations.pdf and our tenant — show me what's actually enforced
Check whether our live config satisfies this requirements document and list the gaps
We built the config with sumsub-create-*, now run the conformance pass against the regulation

How to install sumsub-conformance

1Skills CLI (Vercel)

npx skills add sumsub/agent-skills --skill sumsub-conformance -a claude-code

2Manually: put the files in place

~/.claude/skills/sumsub-conformance/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/sumsub-conformance/

1Skills CLI (Vercel)

npx skills add sumsub/agent-skills --skill sumsub-conformance -a codex

2Manually: put the files in place

.agents/skills/sumsub-conformance/SKILL.md

For all projects use ~/.agents/skills/

1Skills CLI (Vercel)

npx skills add sumsub/agent-skills --skill sumsub-conformance -a cursor

2Manually: put the files in place

.cursor/skills/sumsub-conformance/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install sumsub/agent-skills sumsub-conformance

2Manually: put the files in place

.github/skills/sumsub-conformance/SKILL.md

1Skills CLI (Vercel)

npx skills add sumsub/agent-skills --skill sumsub-conformance -a gemini-cli

2Platform CLI

gemini skills install https://github.com/sumsub/agent-skills --path skills/sumsub-conformance

Manually: put the files in place

.devin/skills/sumsub-conformance/SKILL.md

The legacy .windsurf/skills/ path still works

Skills CLI (Vercel)

npx skills add sumsub/agent-skills --skill sumsub-conformance -a opencode

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about sumsub-conformance

How do I install sumsub-conformance in Claude Code?

Run npx skills add sumsub/agent-skills --skill sumsub-conformance -a claude-code. The skill lands at ~/.claude/skills/sumsub-conformance/SKILL.md.

What does sumsub-conformance do?

It maps each requirement from a regulation onto a deployed Sumsub configuration and reports whether the data is collected, scored and enforced. Requirements that are collected and scored but never acted on get flagged separately.

Which Sumsub token does the skill need?

A sandbox pair: SUMSUB_APP_TOKEN starting with sbx: plus the matching SUMSUB_SECRET_KEY. Production tokens are rejected by the helper.

Similar skills

All skills for Security →

git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set11

sumsub-create-cross-check-preset Creates and edits Sumsub cross-check presets, the rules that decide how names and addresses on POI and POA documents are compared. Useful when the shipped defaults do not fit. CX Codex +1 1,200installs sumsub-create-level Turns a short list of verification steps into a Sumsub applicant level, posts it to the API and shows what the server actually kept. CX Codex +1 1,200installs sumsub-integrate-websdk Walks a web project through the full Sumsub KYC integration, from picking a level to the webhook that finally grants the user access. CX Codex +1 1,200installs sumsub-check-skills-version Compares your installed Sumsub agent-skills package against the published version and warns you when the skills are stale. Runs before Sumsub work. CX Codex +1 1,200installs sumsub-integrate-dint-websdk Adds Sumsub Device Intelligence to an existing WebSDK flow. Use it to bind device signals to an applicant and read device risk labels. CX Codex +1 960installs sumsub-integrate-id-connect Walks your agent through the whole Sumsub ID Connect integration: sign-in button, code-to-token exchange, user consent and applicant creation in your workspace. CX Codex +1 960installs sumsub-integrate-msdk Walks an agent through adding Sumsub Mobile SDK to a native iOS or Android app, from dependency install to launching the verification screen. CX Codex +1 958installs sumsub-create-aml-resolution-rules Builds and publishes Sumsub rules that auto-review AML screening hits: clearing false positives, confirming true ones. CX Codex +1 447installs