Klaviyo 1.0.4

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:52 AM UTC
• Version: 1.0.0

Overview

This skill is not malicious, but it should be reviewed because it can read customer data and change, send, or delete important Klaviyo marketing assets without built-in safeguards.

Install only if you intend to let an agent operate your Klaviyo account through Maton. Use least-privilege OAuth scopes where possible, keep MATON_API_KEY protected, and manually confirm campaign sends, deletes, webhook changes, bulk imports, and subscription or suppression changes after checking the exact target IDs and affected audience size.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a List

```bash
DELETE /klaviyo/api/lists/{list_id}
```

#### Add Profiles to List

• Confidence: 88% confidence
• Finding: The documented delete-list operation is destructive and can remove marketing assets or subscriber organization structures if an agent is induced to call it with attacker-supplied identifiers. Because the skill presents direct DELETE endpoints without any safety interlocks or confirmation guidance, it increases the risk of unauthorized or accidental destructive actions.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Remove Profiles from List

```bash
DELETE /klaviyo/api/lists/{list_id}/relationships/profiles
```

#### Get List Profiles

• Confidence: 89% confidence
• Finding: Removing profiles from a list can alter audience membership, suppress campaign reach, or violate business workflows if triggered through manipulated parameters. In an agent context, exposing this destructive relationship endpoint without warning or confirmation makes parameter abuse materially more dangerous.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a Segment

```bash
DELETE /klaviyo/api/segments/{segment_id}
```

#### Get Segment Profiles

• Confidence: 88% confidence
• Finding: Deleting a segment can disrupt targeting logic and downstream campaigns, especially when an agent acts on ambiguous natural-language instructions. The skill context makes this risk real because segments are business-critical routing objects and the documentation includes the raw destructive endpoint with no cautionary controls.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a Campaign

```bash
DELETE /klaviyo/api/campaigns/{campaign_id}
```

#### Send a Campaign

• Confidence: 91% confidence
• Finding: Deleting a campaign can permanently remove marketing content and operational state, and may be triggered by attacker-controlled campaign IDs or ambiguous user requests. This is particularly dangerous in this skill because it manages real outbound communications and the documentation normalizes direct execution of destructive operations.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a Flow

```bash
DELETE /klaviyo/api/flows/{flow_id}
```

#### Get Flow Actions

• Confidence: 88% confidence
• Finding: Deleting a flow can disable automated customer journeys, causing business interruption and lost revenue. Since flows are long-lived automation objects, an exposed DELETE endpoint in an agent skill without protective guidance creates a substantial risk of accidental or malicious parameter abuse.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a Template

```bash
DELETE /klaviyo/api/templates/{template_id}
```

#### Render a Template

• Confidence: 87% confidence
• Finding: Deleting templates can remove reusable email assets and break campaign or flow content dependencies. The danger is elevated here because template operations may be executed by an agent on behalf of a user, and the documentation does not instruct the agent to verify impact before destructive changes.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Catalog Item

```bash
DELETE /klaviyo/api/catalog-items/{catalog_item_id}
```

#### Get Catalog Variants

• Confidence: 86% confidence
• Finding: Deleting catalog items can affect product synchronization, personalization, and commerce-linked marketing content. In an API skill that accepts arbitrary resource IDs, omission of safety guidance around destructive catalog actions creates a credible parameter-abuse risk.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a Tag

```bash
DELETE /klaviyo/api/tags/{tag_id}
```

#### Tag a Campaign

• Confidence: 83% confidence
• Finding: Deleting tags is less severe than deleting core campaigns or flows, but it can still break organization, filtering, and automation assumptions. The issue is the same pattern: destructive mutation is exposed to agent-driven parameter selection without guardrails.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Tag Group

```bash
DELETE /klaviyo/api/tag-groups/{tag_group_id}
```

### Coupons

• Confidence: 83% confidence
• Finding: Deleting tag groups can disrupt resource organization and any workflows relying on that taxonomy. While not as critical as campaign or flow deletion, the endpoint is still a destructive action that should not be presented without safety guidance in an agent-executable skill.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a Webhook

```bash
DELETE /klaviyo/api/webhooks/{webhook_id}
```

#### Get Webhook Topics

• Confidence: 90% confidence
• Finding: Deleting webhooks can silently disable event delivery to downstream systems, affecting integrations, monitoring, and business processes. In this context, direct webhook deletion is especially risky because an agent may be manipulated into severing external data flows by supplying a target ID.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Universal Content

```bash
DELETE /klaviyo/api/template-universal-content/{content_id}
```

### Bulk Profile Subscriptions

• Confidence: 84% confidence
• Finding: Deleting universal content can break shared content blocks across multiple templates or campaigns, leading to broad unintended impact. The documentation treats this as a simple endpoint call without warning users or agents about its blast radius.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill advertises broad access to customer data and marketing operations, including destructive and privacy-impacting actions, without prominent warnings about consent, deletion, or irreversible effects. In an agent setting, this increases the chance that a user or downstream agent invokes sensitive operations without understanding compliance or business impact.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The examples cover profiles, events, and subscription management involving customer emails, phone numbers, consent state, and behavioral data, but they do not include privacy, consent, or regulatory cautions. In a marketing-data context, omission of such warnings can lead to misuse affecting GDPR/CCPA/CAN-SPAM/TCPA compliance and inappropriate handling of personal data.

Description-Behavior Mismatch

Low

• Confidence: 92% confidence
• Finding: The manifest describes access to profiles, lists, segments, campaigns, flows, events, metrics, templates, catalogs, and webhooks, but the file also documents operations for tags, coupons, accounts, images, forms, reviews, universal content, and bulk subscription/import jobs. This is a semantic mismatch because the advertised scope is narrower than the actual capabilities exposed through the documented gateway paths.

Static analysis

Detected: suspicious.exposed_resource_identifier

Example code exposes a concrete connection_id instead of a placeholder.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: SKILL.md:112