hubspot-integration
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and utilizes official HubSpot SDKs, specifically the '@hubspot/api-client' for Node.js and the 'hubspot' package for Python. These are provided by a well-known service and are used for their intended purpose of API integration.
- [INDIRECT_PROMPT_INJECTION]: The skill operates on external data ingested from HubSpot CRM objects (Contacts, Companies, Deals, and Custom Objects) through methods like
getPage,getById, anddoSearch. This represents a potential attack surface where malicious instructions could be embedded in CRM record properties. The provided templates do not include specific sanitization or boundary markers for this ingested data, though this is typical for code snippets focused on API mechanics. - [CREDENTIALS_SAFE]: The skill correctly implements security best practices by instructing the agent to use environment variables (e.g.,
process.env.HUBSPOT_CLIENT_SECRET,process.env.HUBSPOT_PRIVATE_APP_TOKEN) rather than hardcoding sensitive credentials. It also includes specific 'Validation Checks' to detect and warn against hardcoded API keys or secrets.
Audit Metadata