hubspot-leadgenius
Warn
Audited by Socket on Oct 8, 2026
1 alert found:
AnomalyAnomalySKILL.md
LOWAnomalyLOW
SKILL.md
SUSPICIOUS: The HubSpot side is coherent and uses official endpoints, but the skill’s standout feature is an unverified 'X-Admin-Key' rate-limit bypass requiring an elevated LeadGenius credential not supported by the cited official documentation. That disproportionate admin-token requirement, combined with forwarding it over API calls and the unverifiable LeadGenius auth pattern, makes the skill internally inconsistent enough to classify as suspicious rather than benign.
Confidence: 86%Severity: 58%
Audit Metadata