go-hubspot

• Outcome: Pass
• Latest audit: Oct 17, 2026 · 4:03 AM UTC
• Version: 0.1.1

Overview

This documentation-only Go HubSpot client skill is purpose-aligned, but users should treat HubSpot tokens and write/delete CRM operations carefully.

Install only if you need Go code to call HubSpot. Use least-privilege HubSpot tokens, keep all tokens and developer keys out of logs and source control, and review any generated code that creates, updates, archives, deletes, or purges CRM records before running it against a live account.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: go-hubspot
description: Unofficial Go client for the HubSpot API. `hubspot.NewClientWithResponses("https://api.hubapi.com", ...)` from `github.com/psyb0t/go-hubspot` gives a typed method for every path in HubSpot's unified OpenAPI spec (721 paths), including CRM objects such as contacts, companies and deals, associations, properties, search, marketing, CMS, automation, conversations, files and webhooks. Auth is a Bearer private app or OAuth access token set through a request editor. Responses decode into typed `JSON200`/`JSON201` fields. Use when Go code needs to read or write HubSpot data, or already imports go-hubspot.
homepage: https://github.com/psyb0t/go-hubspot
user-invocable: true
metadata:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

---
name: go-hubspot
description: Unofficial Go client for the HubSpot API. `hubspot.NewClientWithResponses("https://api.hubapi.com", ...)` from `github.com/psyb0t/go-hubspot` gives a typed method for every path in HubSpot's unified OpenAPI spec (721 paths), including CRM objects such as contacts, companies and deals, associations, properties, search, marketing, CMS, automation, conversations, files and webhooks. Auth is a Bearer private app or OAuth access token set through a request editor. Responses decode into typed `JSON200`/`JSON201` fields. Use when Go code needs to read or write HubSpot data, or already imports go-hubspot.
homepage: https://github.com/psyb0t/go-hubspot
user-invocable: true
metadata:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 7)May include surrounding context.

md

- Go 1.26.9 or newer, per the module's `go.mod`.
- Runtime dependency: `github.com/oapi-codegen/runtime`.
- A HubSpot private app access token or OAuth access token with the scopes the endpoints you call need.

## Install

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/setup.md (reported line 54)May include surrounding context.

md

| `Getcrmobjects202603contactsContactIdGetByIdWithResponse` | `GET /crm/objects/2026-03/contacts/{contactId}` |
| `Postcrmobjects202603contactsCreateWithResponse` | `POST /crm/objects/2026-03/contacts` |
| `Patchcrmobjects202603contactsContactIdUpdateWithResponse` | `PATCH /crm/objects/2026-03/contacts/{contactId}` |
| `Deletecrmobjects202603contactsContactIdArchiveWithResponse` | `DELETE /crm/objects/2026-03/contacts/{contactId}` |
| `Postcrmobjects202603contactssearchDoSearchWithResponse` | `POST /crm/objects/2026-03/contacts/search` |
| `Postcrmobjects202603contactsbatchreadReadWithResponse` | `POST /crm/objects/2026-03/contacts/batch/read` |

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file includes instructions to read a sensitive credential from HUBSPOT_DEVELOPER_API_KEY and attach it to requests, but it does not warn users that this is a secret requiring careful storage and exposure controls. Under the markdown-specific missing-warning rule, credential-related behavior that affects privacy or system integrity should be accompanied by a warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.