The Agent Skills Directory

[CREDENTIALS_SAFE]: The skill follows security best practices for secret management. It instructs users to use environment variables (HUBSPOT_CLIENT_SECRET) rather than hardcoding credentials. Code examples correctly reference process.env and provide placeholders like your-client-secret for testing.
[REMOTE_CODE_EXECUTION]: No suspicious remote code execution patterns were found. The skill suggests standard, well-known libraries such as express, ioredis, and bullmq. The shell commands provided are for local testing and interacting with official HubSpot APIs.
[DATA_EXFILTRATION]: All network operations are directed towards well-known, trusted domains including HubSpot's official API (api.hubapi.com). No unauthorized data exfiltration patterns were identified.
[PROMPT_INJECTION]: The instructions are clear and technical. There are no attempts to override agent behavior, bypass safety filters, or extract system prompts.
[OBFUSCATION]: The content was thoroughly scanned for obfuscation techniques including Base64, zero-width characters, and homoglyphs. None were detected; all code and instructions are in plain, human-readable text.
[INDIRECT_PROMPT_INJECTION]: While the skill defines a surface for processing external webhook data, it includes robust security controls to mitigate risks. Specifically, it mandates HMAC-SHA256 signature verification to ensure data integrity and authenticity before processing, effectively neutralizing spoofing or injection attempts from untrusted sources.
[TIME_DELAYED_ATTACKS]: The skill uses timestamp comparisons solely for security purposes (preventing replay attacks) and event ordering guards, which are legitimate architectural requirements for this use case.

hubspot-webhook-handlers