klaviyo-prod-checklist
Facilitates the deployment and validation of Klaviyo integrations for email and SMS marketing, ensuring readiness for production.
Install this skill
Security score
The klaviyo-prod-checklist skill was audited on May 28, 2026 and we found 16 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 110 | error: `${error.status}: ${error.body?.errors?.[0]?.detail || error.message}`, |
Curl to non-GitHub URL
| 138 | STATUS=$(curl -s "https://status.klaviyo.com/api/v2/status.json" | python3 -c "import sys,json; print(json.load(sys.stdin)['status']['description'])" 2>/dev/null) |
Webhook reference - potential data exfiltration
| 35 | - Webhook signing secret configured |
Webhook reference - potential data exfiltration
| 46 | - [ ] Webhook signing secret (`KLAVIYO_WEBHOOK_SIGNING_SECRET`) configured |
Webhook reference - potential data exfiltration
| 67 | #### Webhook Security |
Webhook reference - potential data exfiltration
| 69 | - [ ] Webhook endpoint uses HTTPS only |
Webhook reference - potential data exfiltration
| 72 | - [ ] Webhook endpoint returns 200 within 30 seconds |
Webhook reference - potential data exfiltration
| 192 | | Webhook Signature Invalid | Any rejection | P2 -- verify signing secret | |
Access to .env file
| 97 | const session = new ApiKeySession(process.env.KLAVIYO_PRIVATE_KEY!); |
External URL reference
| 81 | - [ ] Klaviyo status page monitored ([status.klaviyo.com](https://status.klaviyo.com)) |
External URL reference
| 138 | STATUS=$(curl -s "https://status.klaviyo.com/api/v2/status.json" | python3 -c "import sys,json; print(json.load(sys.stdin)['status']['description'])" 2>/dev/null) |
External URL reference
| 147 | "https://a.klaviyo.com/api/accounts/") |
External URL reference
| 156 | "https://a.klaviyo.com/api/profiles/?page[size]=1" 2>/dev/null \ |
External URL reference
| 196 | - [Klaviyo Status Page](https://status.klaviyo.com) |
External URL reference
| 197 | - [API Versioning Policy](https://developers.klaviyo.com/en/docs/api_versioning_and_deprecation_policy) |
External URL reference
| 198 | - [Rate Limits](https://developers.klaviyo.com/en/docs/rate_limits_and_error_handling) |