The Agent Skills Directory

[SAFE]: The skill provides boilerplate code and patterns for integrating with the official klaviyo-api Node.js SDK. The implementation follows standard development practices.
[CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The skill correctly instructs the use of environment variables (process.env.KLAVIYO_PRIVATE_KEY) for managing sensitive API keys, which is a recommended security practice.
[DATA_EXFILTRATION]: No evidence of data exfiltration was found. Network interactions are confined to the official Klaviyo SDK's expected behavior, and there are no suspicious external URLs or data-sending commands.
[OBFUSCATION]: The instructions and implementation code are written in clear, plain-text TypeScript and Markdown. No Base64 encoding, zero-width characters, or homoglyph-based obfuscation techniques were detected.
[REMOTE_CODE_EXECUTION]: The skill does not perform or facilitate remote code execution. It relies on a well-known, legitimate package (klaviyo-api) and does not utilize dangerous functions like eval() or piped shell commands from remote sources.
[INDIRECT_PROMPT_INJECTION]: While the paginate helper in references/implementation.md parses data from API responses (specifically the links.next field), this is a standard requirement for cursor-based pagination and does not present an exploitable surface in this context.

klaviyo-sdk-patterns