hubspot-api

Pass

Audited by Gen Agent Trust Hub on Jul 1, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • Verified API Communication: The skill utilizes curl to interact with api.hubapi.com, the official domain for HubSpot's services. This is a standard and expected pattern for integrating with this CRM.
  • Bundled Utility Scripting: It includes a local bash script (scripts/hs_search.sh) designed to perform searches. This script uses common CLI tools like curl and jq for structured data handling and does not employ risky dynamic code execution patterns.
  • Secure Credential Integration: Authentication is handled by the execution environment, which injects tokens as environment variables. The skill's instructions correctly advise against manual credential management, leveraging the platform's native security features.
  • Data Processing Considerations: The skill processes information retrieved from external CRM records. As with any tool that reads external data, the content is sourced from an external provider and used to inform agent actions.
  • Ingestion points: External record data enters the context via the HubSpot API responses in SKILL.md and scripts/hs_search.sh.
  • Boundary markers: The current instructions do not use specific delimiters to isolate record content from other prompt instructions.
  • Capability inventory: The skill uses standard network operations and file system access to manage records and execute the search script.
  • Sanitization: Record data is parsed as JSON and transformed via jq to ensure consistent data structures.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 1, 2026, 11:17 PM
Security Audit — agent-trust-hub — hubspot-api