ClawHub

HubSpot

v1.0.1

HubSpot CRM and CMS API integration for contacts, companies, deals, owners, and content management.

⭐ 5· 5.5k·25 current·25 all-time
byKevin Wall@kwall1
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (HubSpot CRM/CMS integration) match what the skill asks for: curl + jq and a HubSpot access token. All declared requirements are directly relevant to calling the HubSpot REST API.
✓
Instruction Scope
SKILL.md contains explicit curl examples and endpoint URLs limited to https://api.hubapi.com and uses the declared HUBSPOT_ACCESS_TOKEN. The instructions do not ask the agent to read unrelated files, access other environment variables, or send data to third‑party endpoints.
✓
Install Mechanism
There is no install spec (instruction-only), so nothing is downloaded or written to disk by the skill itself. This is the lowest-risk install model.
ℹ
Credentials
The skill requires a single credential (HUBSPOT_ACCESS_TOKEN), which is appropriate for HubSpot API calls. Reminder: the token grants whatever scopes the private app provides, so grant least privilege and rotate/limit the token in HubSpot. No other unrelated credentials or config paths are requested.
✓
Persistence & Privilege
always:false and no install steps mean the skill does not request persistent system presence or elevated privileges. It is user-invocable and can be called autonomously by the agent (the platform default), which is expected for skills of this type.
Assessment
This skill is internally consistent with its HubSpot integration purpose, but before installing: (1) verify the GitHub homepage (https://github.com/kwall1/hubspot-skill) matches the SKILL.md you expect since the registry source is listed as unknown; (2) provide a HubSpot Private App token with minimal scopes needed (read vs write) and store it securely; (3) rotate or revoke the token if you stop using the skill; (4) replace placeholders in example commands before running them; and (5) be mindful that an agent can call this skill automatically (normal behavior) — avoid granting unnecessarily broad HubSpot scopes if you do not want the agent to create or modify CRM data.

Like a lobster shell, security has layers — review code before you run it.

latestvk971p8yzy32wz4zbp6fnwyva5s818b55

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📊 Clawdis
Binscurl, jq
EnvHUBSPOT_ACCESS_TOKEN
Primary envHUBSPOT_ACCESS_TOKEN

Comments