← Back to Skills Marketplace
HubSpot
by
Kevin Wall
· GitHub ↗
· v1.0.1
7973
Downloads
6
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install hubspot
Description
HubSpot CRM and CMS API integration for contacts, companies, deals, owners, and content management.
Usage Guidance
Review this before installing if the agent may operate against a production HubSpot portal. Use a minimally scoped private app token, keep it out of files and shared logs, prefer a test portal for examples, and require explicit approval before running POST or PATCH commands that create or modify CRM records.
Capability Analysis
Type: OpenClaw Skill
Name: hubspot
Version: 1.0.1
The skill bundle provides a legitimate integration with the HubSpot CRM and CMS API. All `curl` commands target the official `https://api.hubapi.com` domain and use the `HUBSPOT_ACCESS_TOKEN` as expected for authentication. There is no evidence of data exfiltration to unauthorized endpoints, malicious command execution, persistence mechanisms, obfuscation, or prompt injection attempts against the agent to subvert its intended behavior. The use of `curl` and `jq` is standard for API interaction, and while placeholders like `{contactId}` could present a shell injection vulnerability if the agent's execution environment does not properly sanitize user input, this is a platform-level vulnerability rather than malicious intent within the skill's content itself.
Capability Assessment
Credentials
Using curl, jq, network access to api.hubapi.com, and HUBSPOT_ACCESS_TOKEN is proportionate for a HubSpot API skill, but the token may carry broad CRM/CMS permissions depending on how the user scopes it.
Install Mechanism
No installer, dependency download, executable script, or remote payload retrieval is present. The skill is a Markdown instruction file requiring curl, jq, and a HubSpot token.
Instruction Scope
The instructions include POST and PATCH examples for creating contacts and deals, updating contact properties, assigning owners, and creating associations, but do not clearly warn that these change live HubSpot data or require explicit confirmation before mutation.
Persistence & Privilege
No system persistence or local privilege escalation is present, but the skill relies on a high-value HubSpot private app access token and gives only a bare environment-variable example without secret handling, least-privilege, rotation, or logging cautions.
Purpose & Capability
The declared purpose is HubSpot CRM and CMS integration, and the commands target HubSpot API endpoints for contacts, companies, deals, owners, associations, CMS pages, domains, and files. Those capabilities fit the purpose, but include sensitive CRM data access and live mutations.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install hubspot - After installation, invoke the skill by name or use
/hubspot - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
Fix security flags: added homepage for provenance, declared curl/jq as required binaries, updated metadata format
v1.0.0
Initial release - HubSpot CRM and CMS API integration for contacts, companies, deals, owners, and content management.
Metadata
Frequently Asked Questions
What is HubSpot?
HubSpot CRM and CMS API integration for contacts, companies, deals, owners, and content management. It is an AI Agent Skill for Claude Code / OpenClaw, with 7973 downloads so far.
How do I install HubSpot?
Run "/install hubspot" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is HubSpot free?
Yes, HubSpot is completely free (open-source). You can download, install and use it at no cost.
Which platforms does HubSpot support?
HubSpot is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created HubSpot?
It is built and maintained by Kevin Wall (@kwall1); the current version is v1.0.1.
More Skills