The Agent Skills Directory

[SAFE]: The skill provides authoritative and secure architectural patterns for integrating with HubSpot using official SDKs and standard API practices.
[SAFE]: Credentials and secrets are managed correctly by referencing environment variables (e.g., HUBSPOT_CLIENT_SECRET, HUBSPOT_PRIVATE_APP_TOKEN) rather than hardcoding values.
[SAFE]: The skill includes high-quality defensive code, such as HMAC signature validation for webhooks to prevent spoofing and OAuth state verification to mitigate CSRF attacks.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from HubSpot CRM objects and webhooks, creating a surface for indirect prompt injection if those external records contain malicious instructions. The skill mitigates this by providing validation logic for external requests.
Ingestion points: Webhook event data and CRM object search results processed in references/detailed-guide.md.
Boundary markers: Not explicitly defined in the templates to separate record data from system instructions.
Capability inventory: The skill utilizes CRM write operations, schema modification, and association management throughout the provided scripts.
Sanitization: Implemented via HMAC SHA256 signature validation (validateV3) for webhook payloads.

hubspot-integration