Klaviyo

• Outcome: Pass
• Latest audit: May 28, 2026, 6:09 AM
• Version:
  1.0.5

Overview

This is a disclosed Klaviyo API helper that can read and change sensitive marketing data, but its capabilities match its stated purpose and it contains no executable installer or hidden behavior.

Install only if you trust Maton and the connected Klaviyo account scope. Keep MATON_API_KEY secret, use Maton-Connection when multiple accounts exist, prefer narrow reads with sparse fields, and require explicit confirmation of resource name, ID, and effect before any create, update, delete, send, webhook, subscription, or bulk operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: The skill prominently demonstrates listing and manipulating customer profiles, events, subscriptions, and other marketing records without prominent privacy or data-minimization warnings. In an agent setting, this increases the chance of operators performing broad PII access or modification without confirming necessity, scope, or consent.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a List

```bash
DELETE /klaviyo/api/lists/{list_id}
```

#### Add Profiles to List

• Confidence: 84% confidence
• Finding: DELETE /klaviyo/api/lists/{list_id}

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Remove Profiles from List

```bash
DELETE /klaviyo/api/lists/{list_id}/relationships/profiles
```

#### Get List Profiles

• Confidence: 82% confidence
• Finding: DELETE /klaviyo/api/lists/{list_id}/relationships/profiles

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a Segment

```bash
DELETE /klaviyo/api/segments/{segment_id}
```

#### Get Segment Profiles

• Confidence: 83% confidence
• Finding: DELETE /klaviyo/api/segments/{segment_id}

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a Campaign

```bash
DELETE /klaviyo/api/campaigns/{campaign_id}
```

#### Send a Campaign

• Confidence: 86% confidence
• Finding: DELETE /klaviyo/api/campaigns/{campaign_id}

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a Flow

```bash
DELETE /klaviyo/api/flows/{flow_id}
```

#### Get Flow Actions

• Confidence: 84% confidence
• Finding: DELETE /klaviyo/api/flows/{flow_id}

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a Template

```bash
DELETE /klaviyo/api/templates/{template_id}
```

#### Render a Template

• Confidence: 80% confidence
• Finding: DELETE /klaviyo/api/templates/{template_id}

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Catalog Item

```bash
DELETE /klaviyo/api/catalog-items/{catalog_item_id}
```

#### Get Catalog Variants

• Confidence: 80% confidence
• Finding: DELETE /klaviyo/api/catalog-items/{catalog_item_id}

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a Tag

```bash
DELETE /klaviyo/api/tags/{tag_id}
```

#### Tag a Campaign

• Confidence: 77% confidence
• Finding: DELETE /klaviyo/api/tags/{tag_id}

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Tag Group

```bash
DELETE /klaviyo/api/tag-groups/{tag_group_id}
```

### Coupons

• Confidence: 77% confidence
• Finding: DELETE /klaviyo/api/tag-groups/{tag_group_id}

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete a Webhook

```bash
DELETE /klaviyo/api/webhooks/{webhook_id}
```

#### Get Webhook Topics

• Confidence: 83% confidence
• Finding: DELETE /klaviyo/api/webhooks/{webhook_id}

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Universal Content

```bash
DELETE /klaviyo/api/template-universal-content/{content_id}
```

### Bulk Profile Subscriptions

• Confidence: 77% confidence
• Finding: DELETE /klaviyo/api/template-universal-content/{content_id}

VirusTotal

63/63 vendors flagged this skill as clean.