Klaviyo 1.0.4

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:52 AM UTC
• Version: 1.0.0

Overview

This skill is not malicious, but it should be reviewed because it can read customer data and change, send, or delete important Klaviyo marketing assets without built-in safeguards.

Install only if you intend to let an agent operate your Klaviyo account through Maton. Use least-privilege OAuth scopes where possible, keep MATON_API_KEY protected, and manually confirm campaign sends, deletes, webhook changes, bulk imports, and subscription or suppression changes after checking the exact target IDs and affected audience size.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The documented delete-list operation is destructive and can remove marketing assets or subscriber organization structures if an agent is induced to call it with attacker-supplied identifiers. Because the skill presents direct DELETE endpoints without any safety interlocks or confirmation guidance, it increases the risk of unauthorized or accidental destructive actions.

Content

Scanner excerpt · SKILL.md (reported line 371)May include surrounding context.

Delete a List

bash

DELETE /klaviyo/api/lists/{list_id}

Add Profiles to List

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

Removing profiles from a list can alter audience membership, suppress campaign reach, or violate business workflows if triggered through manipulated parameters. In an agent context, exposing this destructive relationship endpoint without warning or confirmation makes parameter abuse materially more dangerous.

Content

Scanner excerpt · SKILL.md (reported line 397)May include surrounding context.

Remove Profiles from List

bash

DELETE /klaviyo/api/lists/{list_id}/relationships/profiles

Get List Profiles

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

Deleting a segment can disrupt targeting logic and downstream campaigns, especially when an agent acts on ambiguous natural-language instructions. The skill context makes this risk real because segments are business-critical routing objects and the documentation includes the raw destructive endpoint with no cautionary controls.

Content

Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.

Delete a Segment

bash

DELETE /klaviyo/api/segments/{segment_id}

Get Segment Profiles

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

Deleting a campaign can permanently remove marketing content and operational state, and may be triggered by attacker-controlled campaign IDs or ambiguous user requests. This is particularly dangerous in this skill because it manages real outbound communications and the documentation normalizes direct execution of destructive operations.

Content

Scanner excerpt · SKILL.md (reported line 545)May include surrounding context.

Delete a Campaign

bash

DELETE /klaviyo/api/campaigns/{campaign_id}

Send a Campaign

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

Deleting a flow can disable automated customer journeys, causing business interruption and lost revenue. Since flows are long-lived automation objects, an exposed DELETE endpoint in an agent skill without protective guidance creates a substantial risk of accidental or malicious parameter abuse.

Content

Scanner excerpt · SKILL.md (reported line 637)May include surrounding context.

Delete a Flow

bash

DELETE /klaviyo/api/flows/{flow_id}

Get Flow Actions

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

Deleting templates can remove reusable email assets and break campaign or flow content dependencies. The danger is elevated here because template operations may be executed by an agent on behalf of a user, and the documentation does not instruct the agent to verify impact before destructive changes.

Content

Scanner excerpt · SKILL.md (reported line 859)May include surrounding context.

Delete a Template

bash

DELETE /klaviyo/api/templates/{template_id}

Render a Template

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

Deleting catalog items can affect product synchronization, personalization, and commerce-linked marketing content. In an API skill that accepts arbitrary resource IDs, omission of safety guidance around destructive catalog actions creates a credible parameter-abuse risk.

Content

Scanner excerpt · SKILL.md (reported line 934)May include surrounding context.

Delete Catalog Item

bash

DELETE /klaviyo/api/catalog-items/{catalog_item_id}

Get Catalog Variants

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 83% confidence

Finding

Deleting tags is less severe than deleting core campaigns or flows, but it can still break organization, filtering, and automation assumptions. The issue is the same pattern: destructive mutation is exposed to agent-driven parameter selection without guardrails.

Content

Scanner excerpt · SKILL.md (reported line 986)May include surrounding context.

Delete a Tag

bash

DELETE /klaviyo/api/tags/{tag_id}

Tag a Campaign

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 83% confidence

Finding

Deleting tag groups can disrupt resource organization and any workflows relying on that taxonomy. While not as critical as campaign or flow deletion, the endpoint is still a destructive action that should not be presented without safety guidance in an agent-executable skill.

Content

Scanner excerpt · SKILL.md (reported line 1034)May include surrounding context.

Delete Tag Group

bash

DELETE /klaviyo/api/tag-groups/{tag_group_id}

Coupons

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Deleting webhooks can silently disable event delivery to downstream systems, affecting integrations, monitoring, and business processes. In this context, direct webhook deletion is especially risky because an agent may be manipulated into severing external data flows by supplying a target ID.

Content

Scanner excerpt · SKILL.md (reported line 1166)May include surrounding context.

Delete a Webhook

bash

DELETE /klaviyo/api/webhooks/{webhook_id}

Get Webhook Topics

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

Deleting universal content can break shared content blocks across multiple templates or campaigns, leading to broad unintended impact. The documentation treats this as a simple endpoint call without warning users or agents about its blast radius.

Content

Scanner excerpt · SKILL.md (reported line 1350)May include surrounding context.

Delete Universal Content

bash

DELETE /klaviyo/api/template-universal-content/{content_id}

Bulk Profile Subscriptions

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises broad access to customer data and marketing operations, including destructive and privacy-impacting actions, without prominent warnings about consent, deletion, or irreversible effects. In an agent setting, this increases the chance that a user or downstream agent invokes sensitive operations without understanding compliance or business impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The examples cover profiles, events, and subscription management involving customer emails, phone numbers, consent state, and behavioral data, but they do not include privacy, consent, or regulatory cautions. In a marketing-data context, omission of such warnings can lead to misuse affecting GDPR/CCPA/CAN-SPAM/TCPA compliance and inappropriate handling of personal data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes access to profiles, lists, segments, campaigns, flows, events, metrics, templates, catalogs, and webhooks, but the file also documents operations for tags, coupons, accounts, images, forms, reviews, universal content, and bulk subscription/import jobs. This is a semantic mismatch because the advertised scope is narrower than the actual capabilities exposed through the documented gateway paths.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_resource_identifier

Example code exposes a concrete connection_id instead of a placeholder.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: SKILL.md:112