hubspot-rate-limit-survival
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were identified in the skill. The code samples provide standard utility functions for interacting with the HubSpot API and managing production-scale throughput.
- [CREDENTIALS_UNSAFE]: The skill correctly demonstrates using environment variables for sensitive access tokens (
HUBSPOT_ACCESS_TOKEN), following best practices to avoid hardcoding secrets. - [EXTERNAL_DOWNLOADS]: Dependencies listed in the instructions and implementation guides are standard, verified packages from npm and PyPI, such as
@hubspot/api-client,requests, andbullmq. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external HubSpot API responses (Ingestion points: CRM record data and headers in
SKILL.md). While explicit boundary markers are not used, the capability inventory is limited to standard API requests and utility processing, and the sanitization (JSON and numeric parsing) is appropriate for the task. The logic is focused on rate-limit handling, presenting no significant risk of indirect injection.
Audit Metadata