klaviyo-data-handling
Facilitates GDPR/CCPA compliance and PII handling for Klaviyo, ensuring data privacy and secure profile management.
Install this skill
Security score
The klaviyo-data-handling skill was audited on May 30, 2026 and we found 12 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 97 | console.log(`Deletion requested for ${JSON.stringify(identifier)}`); |
Template literal with variable interpolation in command context
| 123 | filter: `equals(email,"${email}")`, |
Template literal with variable interpolation in command context
| 126 | if (!profile) throw new Error(`No profile found for ${email}`); |
Template literal with variable interpolation in command context
| 130 | filter: `equals(profile_id,"${profile.id}")`, |
Template literal with variable interpolation in command context
| 169 | redacted = redacted.replace(pattern.regex, `[REDACTED:${pattern.type}]`); |
Template literal with variable interpolation in command context
| 181 | ? `${redacted[field].substring(0, 3)}***` |
Template literal with variable interpolation in command context
| 273 | console.log(`[AUDIT] ${entry.action}: ${entry.identifier} at ${entry.timestamp}`); |
Webhook reference - potential data exfiltration
| 282 | | Sensitive | API keys, webhook secrets | Never log, rotate quarterly | |
Access to .env file
| 52 | const session = new ApiKeySession(process.env.KLAVIYO_PRIVATE_KEY!); |
External URL reference
| 298 | - [Data Privacy API](https://developers.klaviyo.com/en/reference/data_privacy_api_overview) |
External URL reference
| 299 | - [Request Profile Deletion](https://developers.klaviyo.com/en/reference/request_profile_deletion) |
External URL reference
| 300 | - [Consent Collection Guide](https://developers.klaviyo.com/en/docs/collect_email_and_sms_consent_via_api) |