The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to install the required klaviyo-pp-cli binary using npx or go install from the author's own repository and package namespace. Specifically, it references github.com/mvanhorn/printing-press-library and the @mvanhorn/printing-press-library NPM package.
[DATA_EXFILTRATION]: The CLI tool documents a --deliver webhook:<url> flag, which allows the output of any command to be sent to a user-specified external URL. While a powerful capability that could be used for data routing, it is a documented feature for automated workflows.
[COMMAND_EXECUTION]: The skill is primarily designed to drive the klaviyo-pp-cli binary to perform marketing operations, data hygiene tasks, and analytics.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from the Klaviyo API (such as customer profiles and events) and local files (like HTML templates and strategy briefs), which represents an attack surface for instructions embedded in external content.
Ingestion points: Klaviyo API responses (profiles, events, metrics) and local .html or .md files mentioned in the campaigns deploy and plan brief-to-strategy commands.
Boundary markers: The skill does not explicitly define delimiters or warnings to ignore instructions embedded in the processed data.
Capability inventory: Extensive Klaviyo API interaction (read/write), local file reads, and network transmission capabilities via the webhook delivery feature.
Sanitization: The instructions do not specify sanitization or validation steps for external data before it is processed by the agent.

pp-klaviyo