The Agent Skills Directory

[PROMPT_INJECTION]: The skill handles untrusted data from external sources (HubSpot CRM objects and webhooks), which presents a surface for indirect prompt injection. Malicious content stored in CRM fields (such as contact names or descriptions) could potentially influence agent behavior if processed without strict output escaping or delimiters.
Ingestion points: CRM object properties (firstname, lastname, email, custom object properties) and incoming webhook payloads handled in app.post('/webhooks/hubspot', ...).
Boundary markers: The provided code templates do not explicitly include boundary markers or "ignore embedded instructions" warnings for the processed CRM data.
Capability inventory: The skill facilitates network operations via fetch and the official HubSpot SDK for reading and writing CRM data.
Sanitization: The skill demonstrates security best practices by including a signature validation pattern (validateWebhookSignature) using HMAC-SHA256 to ensure data integrity and authenticity of webhook payloads.
[SAFE]: The skill correctly instructs users to use environment variables (process.env.HUBSPOT_CLIENT_SECRET, process.env.HUBSPOT_PRIVATE_APP_TOKEN) rather than hardcoding credentials.
[SAFE]: All network requests are directed to official HubSpot domains (api.hubapi.com, app.hubspot.com), which are well-known services and do not indicate data exfiltration.

hubspot-integration