The Agent Skills Directory

[SAFE]: The skill provides structured incident response procedures for Klaviyo integrations, consistent with its stated purpose as a developer productivity tool.
[EXTERNAL_DOWNLOADS]: Fetches service status information from Klaviyo's official status page (status.klaviyo.com). This targets a well-known service and is a legitimate part of the triage process.
[COMMAND_EXECUTION]: Includes templates for managing secrets and debugging via standard CLI tools (curl, kubectl, gcloud, aws). These tools are explicitly scoped in the frontmatter's allowed-tools and reflect standard administrative workflows.
[REMOTE_CODE_EXECUTION]: An automated scan flagged a pattern where curl output is piped to python3. Analysis confirms this is a false positive; the command uses a Python one-liner to parse JSON status data from Klaviyo's official domain (status.klaviyo.com) rather than executing remote scripts.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the Klaviyo status API. While this is an ingestion point, the scripts extract specific fields (d['status']['description']) rather than processing free-text instructions, presenting a negligible risk. Ingestion occurs in references/triage.md using curl without explicit sanitization or boundary markers, which is typical for status monitoring.

klaviyo-incident-runbook