Is kit safe?

Every API call is proxied through gateway.maton.ai rather than going directly to api.kit.com. This means the Maton service has full visibility into all request and response data, including subscriber PII (email addresses, names, custom fields). Users are implicitly trusting a third party with their Kit account data.

The skill documents how to create webhooks with arbitrary target_url values. An agent could be instructed (or a prompt injection could cause it) to create webhooks that send subscriber activity data to attacker-controlled endpoints.

The skill description includes a recommendation to install another skill ('api-gateway') with a direct URL. While not malicious, this creates a funnel that could lead users to install progressively more privileged skills.

Code examples use python heredoc patterns (python <<'EOF') that an LLM agent would execute directly via shell. While these are standard documentation patterns, they expand the execution surface if the agent auto-runs examples without user confirmation.

The skill's architecture requires users to delegate their Kit OAuth token management to Maton. The gateway 'automatically injects your OAuth token', meaning Maton stores and manages the user's Kit credentials. This is a significant trust delegation beyond what a simple API wrapper implies.

The skill installed cleanly with no network connections, no process spawning, and no filesystem modifications outside expected paths. All observed filesystem activity was from the platform's own install toolchain.