HubSpot

HubSpot CRM and CMS API integration for contacts, companies, deals, owners, and content management.

Install only if you are comfortable letting the agent use a HubSpot private app token. Use a dedicated least-privilege token, avoid sharing it in prompts or logs, confirm any create/update/owner-assignment action before it runs, and prefer a sandbox or test records when setting it up.

Type: OpenClaw Skill Name: hubspot Version: 1.0.1 The skill bundle provides a legitimate integration with the HubSpot CRM and CMS API. All `curl` commands target the official `https://api.hubapi.com` domain and use the `HUBSPOT_ACCESS_TOKEN` as expected for authentication. There is no evidence of data exfiltration to unauthorized endpoints, malicious command execution, persistence mechanisms, obfuscation, or prompt injection attempts against the agent to subvert its intended behavior. The use of `curl` and `jq` is standard for API interaction, and while placeholders like `{contactId}` could present a shell injection vulnerability if the agent's execution environment does not properly sanitize user input, this is a platform-level vulnerability rather than malicious intent within the skill's content itself.