klaviyo-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from Klaviyo webhooks, which constitutes an indirect injection surface.
- Ingestion points: Express.js endpoint processing POST requests in
references/implementation.md. - Boundary markers: Robust HMAC-SHA256 signature verification is implemented in
src/klaviyo/webhook-verify.tsto ensure data originates from a trusted source. - Capability inventory: Handlers perform database upserts and analytics tracking based on payload content, as detailed in
references/implementation.md. - Sanitization: The skill enforces raw body validation against a signing secret before parsing or acting upon the data.
Audit Metadata