klaviyo-multi-env-setup
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to build an application that ingests external configuration through environment variables which could potentially influence agent actions if the output is processed downstream.
- Ingestion points: Environment variables like
KLAVIYO_PRIVATE_KEYandNODE_ENVare used insrc/config/klaviyo.tsandsrc/startup.tsto determine application behavior. - Boundary markers: The skill explicitly implements environment guards (
requireProduction,guardCampaignSend) to act as logic boundaries, throwing errors if dangerous operations are attempted in the wrong context. - Capability inventory: The skill uses
WriteandEdittools to create configuration files andBashfor secret management via AWS, GCP, and Vault CLI tools. - Sanitization: Implementation code includes validation logic in
src/startup.tsthat explicitly checks for and warns about mismatched credentials (e.g., production keys in development environments).
Audit Metadata