klaviyo-analyst

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill's primary purpose is marketing analysis, and all identified behaviors align with this purpose. It facilitates auditing flows, segments, and campaigns using official Klaviyo APIs.
  • [COMMAND_EXECUTION]: The skill includes Python scripts (scripts/analyze.py and scripts/klaviyo_client.py) for data processing. These scripts use standard argument parsing and do not contain unsafe execution patterns like eval() or os.system() with untrusted input.
  • [EXTERNAL_DOWNLOADS]: The skill provides installation instructions via git clone from the author's official GitHub repository (github.com/thatrebeccarae). This is a standard installation method for custom skills and matches the provided author metadata.
  • [DATA_EXFILTRATION]: No unauthorized data transfer was detected. Network operations are limited to communicating with the official Klaviyo API domain (a.klaviyo.com) for the purpose of retrieving marketing data.
  • [CREDENTIALS_UNSAFE]: The skill follows security best practices by instructing users to store API keys in environment variables or .env files rather than hardcoding them. It also recommends using read-only API scopes for analyst tasks.
  • [DYNAMIC_EXECUTION]: The provided scripts include a _safe_output_path utility function that prevents directory traversal attacks by ensuring file exports remain within the current working directory.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 11:39 PM