# sumsub-conformance

Walks a live Sumsub configuration and answers one question per requirement: is it collected, scored, enforced? Flags the items that are gathered and scored but never acted on.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 973 installs · ★ 7
- Author: sumsub
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/sumsub/agent-skills/tree/HEAD/skills/sumsub-conformance/SKILL.md
- Updated: 2026-10-02
- HTML: https://affpapa.org/en/nevibecode/skills/sumsub-conformance

## What it does

Point the skill at a requirements document — PDF or plain text — and it lines that document up against a tenant's deployed Sumsub configuration. Each requirement gets traced through the config graph to the place where the data is collected, where it is scored, and where something actually happens because of it. The finding it surfaces is the collected-but-not-enforced case: a questionnaire that gets scored and then routes nowhere.

Everything runs against read-only Sumsub endpoints, signed with App-Token HMAC. `resolve_graph.sh` builds the graph, `trace.py` and `report.py` produce the verdict, and `python3 scripts/graph_summary.py "$CONFIG"` prints the section and item indices when you want to look at the graph yourself. Output files land next to the regulation you fed in, named from its stem: `<stem>_regulations.json`, `<stem>_config.json`, `<stem>_report.md`.

You need `SUMSUB_APP_TOKEN` and `SUMSUB_SECRET_KEY`. Sandbox only — the helper turns down any token that does not start with `sbx:`, so a production pair has to be swapped out before the run. When the graph cannot be resolved the script stops there, and no verdict comes out of a partial graph. Treat the output as a gap report rather than a compliance guarantee: semantic intent and whatever the SDK does downstream still need a human to sign off.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add sumsub/agent-skills --skill sumsub-conformance -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/sumsub-conformance/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/sumsub-conformance/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add sumsub/agent-skills --skill sumsub-conformance -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/sumsub-conformance/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add sumsub/agent-skills --skill sumsub-conformance -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/sumsub-conformance/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install sumsub/agent-skills sumsub-conformance
```

2. **Manually: put the files in place**
- File: `.github/skills/sumsub-conformance/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add sumsub/agent-skills --skill sumsub-conformance -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/sumsub/agent-skills --path skills/sumsub-conformance
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/sumsub-conformance/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add sumsub/agent-skills --skill sumsub-conformance -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/sumsub/agent-skills/tree/HEAD/skills/sumsub-conformance/SKILL.md

## When to use it
- verify that every clause of a regulation is actually enforced in a tenant's config
- spot questionnaires and checks that collect data without acting on it
- close the generate-then-verify loop after building config with `sumsub-create-*`
- audit a client's setup against compliance rules
- get a per-requirement report instead of eyeballing workflow JSON

## Example prompts
- Here's `Level4regulations.pdf` and our tenant — show me what's actually enforced
- Check whether our live config satisfies this requirements document and list the gaps
- We built the config with `sumsub-create-*`, now run the conformance pass against the regulation

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [sumsub/agent-skills](https://affpapa.org/en/nevibecode/by/sumsub/agent-skills.md) — 20 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md