klaviyo-automation
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the configuration of an external MCP server located at
https://rube.app/mcpfor tool execution. - [PROMPT_INJECTION]: The skill processes untrusted data from Klaviyo campaign messages, creating a surface for indirect prompt injection.
- Ingestion points: Campaign message content (subject, body) retrieved via
KLAVIYO_GET_CAMPAIGN_MESSAGEinSKILL.md. - Boundary markers: Absent; the instructions do not define delimiters for external data.
- Capability inventory: The skill performs read and monitoring operations on campaign data via Rube MCP tools.
- Sanitization: Absent; the instructions do not include logic to sanitize or filter the content of campaign messages before processing.
Audit Metadata