Security audit
Security checks for vulnerabilities and agentic risk
This HubSpot skill is a disclosed Maton CLI/API integration with strong approval and least-privilege guidance for sensitive CRM operations.
Install only if you intend to let Maton access your HubSpot account. Use least-privilege OAuth scopes, confirm every write/delete/bulk operation, and be especially careful with triggers or destinations because they can forward future CRM events automatically until removed.
Line L003 states this shared reference 'does not widen' the app the skill is about. Yet the file goes on to document triggerable events for tickets, an object type not included in the manifest's documented CRM surface, creating a direct documentation-level contradiction about whether this material expands what the skill covers.
The manifest says the documented HubSpot surface is limited to CRM contacts, companies, deals, associations, and properties, and that anything outside that documented surface should be user-requested by endpoint name. This file, however, exposes ticket.created, ticket.updated, and ticket.deleted as part of the skill's reference material, which broadens the apparent supported HubSpot object scope beyond what the manifest says is documented.
No suspicious patterns detected.
