The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes data from the Klaviyo API, which could contain untrusted marketing content designed to influence the agent's recommendations.
Ingestion points: scripts/klaviyo_client.py fetches campaign, flow, and segment data.
Boundary markers: Absent; marketing data is processed directly within the analysis workflow.
Capability inventory: The skill performs extensive reporting and utilizes an MCP server with write capabilities for campaigns, templates, and profiles.
Sanitization: No explicit sanitization or filtering of external marketing content is identified in the provided scripts.
[SAFE]: The skill's fallback scripts implement defensive measures to prevent path traversal attacks during file operations.
Evidence: The _safe_output_path function in scripts/analyze.py and scripts/klaviyo_client.py ensures that any generated reports or data exports remain within the current working directory.
[SAFE]: The skill promotes secure credential management practices.
Evidence: The instructions in SKILL.md and .env.example explicitly advise against hardcoding API keys and recommend using environment variables or a .env file excluded from version control.

klaviyo-analyst