klaviyo-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides secure implementation patterns for Klaviyo API key management. It correctly identifies the criticality of Private API keys and provides a validated configuration loader that fails fast on missing secrets. The provided rotation runbook uses standard CLI tools (Vercel, AWS, GCP) and official Klaviyo API endpoints for verification.
- [INDIRECT_PROMPT_INJECTION]: The skill describes an integration pattern for ingesting untrusted external data via webhooks, which presents a surface for indirect injection if not handled securely.
- Ingestion points: The Express endpoint
/webhooks/klaviyoinimplementation.mdreceives external POST requests. - Boundary markers: The skill explicitly implements a security boundary using HMAC-SHA256 signature verification (
verifyKlaviyoWebhookSignature) and timing-safe comparisons. - Capability inventory: The code parses the payload using
JSON.parsefor downstream processing of events. - Sanitization: While integrity is verified via HMAC, the skill does not detail sanitization or schema validation of the JSON content itself.
Audit Metadata