klaviyo-send-email
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses several shell scripts (
campaign.sh,audience.sh,lists.sh,profiles.sh) to interface with the Klaviyo REST API. These scripts use standard tools likecurlfor network requests andpython3for JSON processing. - [DATA_EXPOSURE]: API keys are managed via the
KLAVIVO_API_KEYenvironment variable or stored locally in~/.config/klaviyo-send-email/api_key. This follows standard practices for CLI-based secret management. The skill explicitly warns against printing API keys and instructs users on how to rotate them if exposed. - [SAFE_PRACTICES]: All write actions (create, update, delete, send) perform a dry-run by default, requiring an explicit
--sendflag to execute the actual API request. This provides a safety layer to prevent accidental modifications or campaign sends.
Audit Metadata